Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/07/01 8:10 p.m.25 views

SurrealDB: Graph traversal bypasses table SELECT permissions

An authenticated record or scope user could read records on any table reachable through a graph edge or REFERENCES TO back-reference, regardless of that table's PERMISSIONS FOR select clause. Traversing SELECT FROM source-edge-target returned full documents from target even when target was define...

7.1CVSS5.9AI score0.00399EPSS
SaveExploits0References4Affected Software1
Rows per page
Query Builder