SurrealDB has an Authorization Bypass via Composite Record-id Paths

An authenticated user could bypass permission rules that gated access on parts of a record's id — most commonly tenant-isolation rules of the form PERMISSIONS FOR select WHERE id.tenant = $auth.id.tenant. The same defect also let UNIQUE constraints defined on parts of an id admit duplicate entrie...

GHSA-6VG3-HGRW-P5GF SurrealDB has an Authorization Bypass via Composite Record-id Paths

An authenticated user could bypass permission rules that gated access on parts of a record's id — most commonly tenant-isolation rules of the form PERMISSIONS FOR select WHERE id.tenant = $auth.id.tenant. The same defect also let UNIQUE constraints defined on parts of an id admit duplicate entrie...

Unspecified vulnerability in Lunary (CNVD-2025-06934)

Lunary is Lunary open source a production toolkit for LLM . A security vulnerability exists in Lunary versions prior to 1.6.3 that stems from not enforcing unique constraints and can be exploited by an attacker to cause data integrity issues...

PT-2025-12105 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions prior to 1.6.3 Description: The application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This enables an attacker to overwrite existing data by...

Lunary 安全漏洞

Lunary is Lunary open source a production toolkit for LLM . A security vulnerability exists in Lunary versions prior to 1.6.3 that stems from not enforcing unique constraints and can be exploited by an attacker to cause data integrity issues...