SurrealDB versions before 3.2.0 contain a vulnerability where custom API routes do not properly validate namespace and database scope. This allows authenticated users to access or invoke endpoints across different namespaces or databases by manipulating the URL path. The flaw can lead to unauthorized data access or unintended operations within other tenants' scopes.