SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by… (CVE-2026-109340)

The vulnerability in SurrealDB versions 3.1.0 before 3.3.0 involves an authorization bypass where authenticated users who have delete permissions on a referenced table can delete records that cause a REFERENCE ON DELETE CASCADE operation. This cascade disables permission checks for edge cleanup, enabling deletion of protected graph edges even if the edge table's permissions explicitly forbid deletion. The issue is tracked as CVE-2026-109340 and has a CVSS 3.1 base score of 5.4, indicating a medium severity impact.

An attacker with valid delete permissions on a referenced table can delete records that trigger cascading deletes, bypassing the permission restrictions on the edge table. This results in unauthorized deletion of protected graph edges, causing potential data integrity issues and loss of graph relationships. There is no indication of confidentiality impact, but integrity and availability impacts are present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict delete permissions on referenced tables to trusted users only to minimize risk of exploitation.