CVE-2026-109333

SurrealDB versions 3.0.0 before 3.3.0 are vulnerable to an authorization bypass (CWE-862) that allows authenticated users to perform cross-tenant record reads . By switching to a foreign namespace or database and using a known record ID within a RETURN … FETCH query, an attacker can access data b...