SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or… (CVE-2026-109342)

SurrealDB versions 3.0.0 before 3.3.0 contain a missing authentication vulnerability (CWE-306) in the revoke RPC method. This vulnerability permits low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attackers can acquire grant identifiers via ACCESS SHOW ALL with VIEWER permission or from leaked tokens, then use these identifiers to revoke refresh tokens, causing forced re-authentication. The CVSS 3.1 base score is 5.4 (medium severity), with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, low integrity impact, and low availability impact.

The vulnerability allows attackers with low privileges or no authentication to revoke refresh tokens of other users, forcing them to re-authenticate. This can disrupt user sessions and availability but does not directly compromise confidentiality. The integrity of the system is impacted at a low level due to unauthorized token revocation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the revoke RPC method and monitor for suspicious token revocation activity. Avoid leaking tokens and limit VIEWER permission to trusted users only.