Threats tagged 'ghsa-848m-r628-vrxw'

SurrealDB versions prior to 3.2.0 contain a vulnerability where an authenticated user scoped to one namespace/database can invoke a custom API belonging to another namespace/database by manipulating the URL path. This allows the user to access or modify data in another tenant's scope if the endpoint permissions are permissive. The vulnerability does not allow unauthenticated access or affect single-tenant deployments. Versions 3.2.0 and later include a fix that validates the namespace/database against the caller's authenticated scope, rejecting unauthorized cross-tenant access.