SurrealDB versions before 3.1.0 contain a vulnerability where table SELECT permissions are not enforced during graph traversal. Authenticated users can read records from any table reachable through graph edges, bypassing intended access controls. This issue allows unauthorized data disclosure without requiring elevated privileges beyond authentication.