medium5.4
CVE-2026-109340
SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering …
Impact
SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permission checks for edge cleanup, erasing edges despite the edge table's PERMISSIONS FOR delete clause.
Affected products
| Product | Affected versions |
|---|---|
| SurrealDB From 3.1.0 | before 3.3.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.