CVE-2026-109343
SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a…
- Risk score
- 52/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 12 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows i…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.3.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.1 high
References
Original description
SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows in tables whose PERMISSIONS allow it, such as PERMISSIONS FULL.
Last activity 12 Oct 2026. Patch Forecast updates every hour.