CVE-2026-109340GHSA-4w65-7h3j-p29h
SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE
surrealdb surrealdb
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.3.0surrealdbCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permission checks for edge cleanup, erasing edges despite the edge table's PERMISSIONS FOR delete clause.
Text from CVE List
Affected versions 2
- surrealdbaffected: 3.1.0 before 3.3.0CVE List
- surrealdbunaffected: 3.3.0CVE List