Authorization Bypass Vulnerability in SurrealDB Affects Data Integrity

CVE-2026-109340

What is CVE-2026-109340?

SurrealDB versions 3.1.0 through 3.2.0 are susceptible to an authorization bypass vulnerability that can lead to the deletion of protected graph edges. Specifically, authenticated users with delete privileges on a referenced table can exploit the REFERENCE ON DELETE CASCADE feature to remove records without triggering the requisite permission checks. This could result in critical data loss as the edge cleanup process fails to enforce the established delete permissions, undermining the integrity of the database.

References