CVE-2026-109333
SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows…
- Risk score
- 43/100
- CVSS
- 6.5 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known record id in a RETURN … FETCH query to re…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.3.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.5 medium
References
Original description
SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known record id in a RETURN … FETCH query to read another tenant's data when table PERMISSIONS allow reads.
Last activity 12 Oct 2026. Patch Forecast updates every hour.