Threat Intelligence Database

SurrealDB versions from 3.0.0 up to but not including 3.3.0 have a missing authentication vulnerability in the revoke RPC method. This flaw allows low-privileged or unauthenticated users to revoke other users' refresh tokens without proper proof of possession. Attackers can obtain grant identifiers through ACCESS SHOW ALL with VIEWER permission or leaked tokens, enabling them to force re-authentication by permanently revoking refresh tokens.

SurrealDB versions from 3.1.0 up to but not including 3.3.0 have an authorization bypass vulnerability. Authenticated users with delete permission on a referenced table can delete records that trigger a cascade delete, bypassing permission checks on protected graph edges. This allows deletion of edges despite explicit delete restrictions on the edge table.

SurrealDB versions prior to 3.3.0 contain a vulnerability where the SurrealQL USE statement allows authenticated users to switch sessions to any namespace or database without proper authorization checks. This flaw enables cross-tenant access, permitting users to read, create, update, or delete data in other tenants' tables if permissions allow, such as with full permissions.

SurrealDB versions 3.1.0 up to but not including 3.3.0 contain a vulnerability where Surrealism modules can exhaust server memory by buffering stdout/stderr lines without bounds. This bypasses configured memory limits, allowing an attacker with Owner privileges to run a malicious module that writes output without newlines, causing the server to crash and resulting in denial of service across all namespaces and databases.

SurrealDB versions before 3.3.0 have an authorization bypass vulnerability that allows users with table-level write permissions to read fields normally restricted by SELECT permissions. This is achieved by exploiting JSON Patch operations to access hidden data fields. The vulnerability can lead to unauthorized data disclosure without requiring elevated privileges beyond write access.

SurrealDB versions before 3.3.0 have an authorization bypass vulnerability that permits record users to access fields that should be hidden by field-level SELECT permissions. This occurs via LIVE SELECT projections, allowing attackers to retrieve restricted field values by projecting them from the unreduced $after or $before parameters under an alias during CREATE, UPDATE, and DELETE notifications.

SurrealDB versions before 3.3.0 have an authorization bypass vulnerability that enables record users to infer values of fields protected by field-level SELECT permissions. This is achieved by using LIVE SELECT WHERE predicates with $before or $after to observe notification behavior on record CREATE, UPDATE, or DELETE events. The vulnerability allows attackers to confirm or narrow down restricted field values without direct access.

SurrealDB versions from 3.0.0 up to but not including 3.3.0 contain an authorization bypass vulnerability. This flaw allows authenticated users to read records in other namespaces or databases by exploiting the FETCH operation to resolve record IDs. Attackers can switch to a foreign namespace or database and specify a known record ID in a RETURN ... FETCH query to access data belonging to other tenants if table permissions allow read access.

SurrealDB versions before 3.3.0 contain an access control vulnerability where the system does not properly verify the caller-selected namespace or database against the authenticated user's permission level. This flaw allows an authenticated attacker to access and manipulate data across tenant boundaries if table permissions permit.

SurrealDB versions from 3.0.0 up to but not including 3.3.0 have an information disclosure vulnerability. This flaw allows users with record access to read data that should be hidden by field-level SELECT permissions via COMPUTED fields. Attackers can exploit this by selecting records with readable COMPUTED fields derived from hidden fields or by using write RETURN clauses with $before/$after to reveal concealed values. The vulnerability has a CVSS score of 6.5, indicating a high severity level.