GHSA-66R2-5GWJ-GXM2 SurrealDB: Writes in a PERMISSIONS clause bypass table permissions

A PERMISSIONS ... WHERE clause is evaluated with permission enforcement disabled, so it can't recurse into its own checks. But the clause could also contain data-modifying statements, and these ran with enforcement still off — so evaluating a permission check could write to tables the caller cann...

EUVD-2026-45904

SurrealDB: Writes in a PERMISSIONS clause bypass table permissions...

SurrealDB: Writes in a PERMISSIONS clause bypass table permissions

A PERMISSIONS ... WHERE clause is evaluated with permission enforcement disabled, so it can't recurse into its own checks. But the clause could also contain data-modifying statements, and these ran with enforcement still off — so evaluating a permission check could write to tables the caller cann...

GHSA-6G69-7XMF-H2X7 Duplicate Advisory: Writes in a PERMISSIONS clause bypass table permissions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-66r2-5gwj-gxm2. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within...

Duplicate Advisory: Writes in a PERMISSIONS clause bypass table permissions

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-66r2-5gwj-gxm2. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within...

CVE-2026-63733

SurrealDB prior to 3.2.0 is affected by a permissions bypass where data-modifying statements inside a PERMISSIONS clause execute with enforcement disabled. When an attacker has permission to perform a guarded operation, they can embed CREATE, UPDATE, DELETE, or UPSERT statements within the PERMIS...

PT-2024-40015

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.1.4 Description The issue concerns the OVERWRITE clause of the DEFINE TABLE statement, which fails to overwrite data for tables defined with TYPE RELATION. This failure affects the PERMISSIONS clause, potentially...