SurrealDB Vulnerability: Unauthorized Data Modifications Risk
- Severity
- HIGH
- Affected component
- surrealdb (npm)
- Patched version
- 3.2.0
An early warning has been issued for a vulnerability in SurrealDB versions prior to 3.2.0. This vulnerability allows unauthorized data modifications by bypassing table permissions.
What happened
SurrealDB versions before 3.2.0 reportedly contain a vulnerability that allows writes in a PERMISSIONS clause to bypass table permissions. This enables unauthorized users to modify data in ways that should be restricted. The vulnerability is tracked under GHSA-66R2-5GWJ-GXM2 and has a high severity rating. It is under investigation and has not been exploited in the wild as of the latest reports.
Additionally, another advisory under GHSA-848m-r628-vrxw indicates that a custom API route in SurrealDB allows authenticated callers to override namespace and database scope via URL path. This further compounds the risk by potentially allowing unauthorized access to sensitive data.
What to do about it
- Upgrade your SurrealDB installation to version 3.2.0 or later to mitigate the vulnerability.
- Review your SurrealDB configurations and permissions to ensure they align with your security policies.
- Monitor the SurrealDB security advisories and update your installations as patches become available.
How 0Day would have caught this
surrealdb is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using SurrealDB versions prior to 3.2.0, you are potentially affected by this vulnerability.
What should I do right now?
Immediately upgrade to SurrealDB version 3.2.0 or later. Review and adjust your database permissions and configurations to enhance security.
Has this vulnerability been exploited in the wild?
There are no reports of this vulnerability being exploited in the wild at this time.