Cross-Tenant Access Flaw in SurrealDB Affects Multiple Versions

CVE-2026-109343

What is CVE-2026-109343?

SurrealDB versions before 3.3.0 are susceptible to an access control vulnerability that enables cross-tenant access. The SurrealQL USE statement permits a session to switch between namespaces and databases without verifying that the caller's authenticated level is in accordance with the required permissions. Consequently, authenticated users may inadvertently switch to another tenant's context, gaining unauthorized access to read, create, update, or delete data in tables where permissions allow it, significantly compromising data security.

References