SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other… (CVE-2026-109333)

CVE-2026-109333 describes an authorization bypass vulnerability in SurrealDB versions 3.0.0 through before 3.3.0. The vulnerability arises because authenticated users can leverage the FETCH operation to resolve record IDs across namespaces or databases. By switching to a foreign namespace or database and naming a known record ID in a RETURN ... FETCH query, an attacker can read records belonging to other tenants when table permissions permit reads. This bypasses intended access controls and exposes sensitive data across tenant boundaries.

The vulnerability allows unauthorized read access to data in other namespaces or databases by authenticated users, potentially leading to data disclosure across tenants. The CVSS score of 6.5 (High) reflects the network attack vector, low attack complexity, and no user interaction required, with confidentiality impact rated high. There is no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to minimize exposure and monitor for unusual FETCH query usage. Avoid granting read permissions broadly across tables that could be exploited via this vulnerability.