CVE-2026-109333

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-862

Impact

Authenticated record users can read unauthorized data across different namespaces or databases. Attackers need valid account access and knowledge of target record IDs to execute queries across tenant boundaries.

Root cause

Missing authorization checks allow cross-tenant record ID resolution during RETURN ... FETCH queries when table permissions allow reads.

Affected systems

SurrealDB from 3.0.0 before 3.3.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade SurrealDB to version 3.3.0 or higher. No interim configuration mitigation is documented.

shell

$ surreal upgrade --version 3.3.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known record id in a RETURN … FETCH query to read another tenant's data when table PERMISSIONS allow reads.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109333