4 matches found
CVE-2026-121416
SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax...
CVE-2026-121416
SurrealDB versions 2.0.0 before 3.3.1 are vulnerable to a capability bypass in the streaming engine. The root cause is that MethodPart::evaluate invokes resolved functions without performing a capability check, failing to enforce --deny-funcs restrictions on method-style function calls. Consequen...
CVE-2026-121416 SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations
SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax...
CVE-2026-121416: surrealdb: SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming…
SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax...