1 matches found
SurrealDB: Graph traversal bypasses table SELECT permissions
An authenticated record or scope user could read records on any table reachable through a graph edge or REFERENCES TO back-reference, regardless of that table's PERMISSIONS FOR select clause. Traversing SELECT FROM source-edge-target returned full documents from target even when target was define...
7.1CVSS5.9AI score0.00399EPSS
SaveExploits0References4Affected Software1
20