SurrealDB: Graph traversal bypasses table SELECT permissions (CVE-2026-63746)

CVE-2026-63746 in SurrealDB allows an authenticated user with select permission on a source table to read records from any target table reachable through graph edges or REFERENCES TO back-references, regardless of the target table's select permissions. The root cause is that GraphEdgeScan and ReferenceScan operations bypass the usual permission checks by fetching records directly from storage without applying the Document::pluck_select permission filtering. This results in unauthorized data exposure along multi-hop graph traversal chains. The issue is confined to confidentiality within the same database and does not affect isolation boundaries. The vulnerability is fixed in SurrealDB version 3.1.0 by introducing a per-batch permission cache that enforces select permissions during graph traversals.

An authenticated user with select permission on a table can read data from other tables connected by graph edges or back-references, even if those tables explicitly deny select permission. This leads to unauthorized disclosure of confidential data within the same database. The vulnerability does not affect integrity or availability, nor does it break namespace or database isolation boundaries.

A patch is available in SurrealDB version 3.1.0 and later that fixes this permission bypass. Users should upgrade to version 3.1.0 or newer to remediate the issue. As a workaround, remove select permission on edge tables whose target tables should remain hidden. Additionally, use namespace or database isolation as the primary security boundary where possible.