CVE-2026-109342

SurrealDB versions 3.0.0 before 3.3.0 are vulnerable to a missing authentication flaw in the revoke RPC method . This allows low-privileged or unauthenticated callers to permanently revoke other users' refresh tokens without proof of possession. Attackers can acquire necessary grant identifiers u...

EUVD-2026-97644

SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attackers can obtain grant identifiers via ACCESS SHOW ALL with...