CVE-2026-109340

SurrealDB versions 3.1.0 before 3.3.0 are vulnerable to an authorization bypass (CWE-862). The flaw allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE . Specifically, an attacker with delete permissions on a referenced table can delete a record ...

EUVD-2026-97642

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permissio...