Authorization Bypass in SurrealDB by SurrealDB Inc.

CVE-2026-109333

What is CVE-2026-109333?

SurrealDB versions from 3.0.0 up to 3.2.0 are susceptible to an authorization bypass vulnerability that permits authenticated users to access records from other namespaces or databases. By exploiting the FETCH command, attackers can leverage knowledge of record IDs to conduct unauthorized data retrieval. This occurs when table permissions permit read access, effectively allowing users to switch contexts and expose data across tenants. Proper access controls and validation measures are essential to mitigate this risk.

References