CVE-2026-109340
5.4MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-862
Impact
Authenticated users can delete protected graph edges that they normally lack permissions to modify. An attacker only needs network access and a low-privilege account with delete access to a referenced table.
Root cause
Triggering a REFERENCE ON DELETE CASCADE fails to enforce PERMISSIONS FOR delete checks when cleaning up associated edge records.
Affected systems
SurrealDB from 3.1.0 before 3.3.0
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Fix & remediation
Upgrade SurrealDB to version 3.3.0 or higher. If you cannot patch immediately, temporarily remove ON DELETE CASCADE clauses from schema reference definitions that cascade into protected edge tables.
$ surreal upgrade --version 3.3.0AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permission checks for edge cleanup, erasing edges despite the edge table's PERMISSIONS FOR delete clause.