CVE-2026-109340

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permissio...

CVE-2026-109340

SurrealDB versions 3.1.0 before 3.3.0 are vulnerable to an authorization bypass (CWE-862). The flaw allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE . Specifically, an attacker with delete permissions on a referenced table can delete a record ...

CVE-2026-109340 SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permissio...

EUVD-2026-97642

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permissio...

CVE-2026-109340: Missing Authorization

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permissio...

PT-2026-110757

Name of the Vulnerable Software and Affected Versions SurrealDB versions 3.1.0 through 3.2.x Description An authorization bypass allows authenticated users to delete protected graph edges. This occurs when a user with delete permissions on a referenced table triggers a REFERENCE ON DELETE CASCADE...

CVE-2026-63746

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause...

CVE-2026-63746: Exposure of Sensitive Information to an Unauthorized Actor

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause...

PT-2026-57512

An authenticated record or scope user could read records on any table reachable through a graph edge or REFERENCES TO back-reference, regardless of that table's PERMISSIONS FOR select clause. Traversing SELECT FROM source-edge-target returned full documents from target even when target was define...

kernel: eventpoll: Fix semi-unbounded recursion

In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EPMAXNESTS+1 links. Currently, eploopcheckproc ensures that the graph is loop-free and does some recursion depth checks, but...

PT-2025-33812

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The Linux kernel contains a flaw within the eventpoll subsystem that could allow for semi-unbounded recursion. The issue stems from insufficient depth checks when creating graph edges...