CVE-2026-63746

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0

Description Authenticated record or scope users can bypass table SELECT permissions when traversing graph edges or REFERENCES TO back-references. This allows users to read records from any table reachable through a sequence of edges, even if the target table is configured with PERMISSIONS FOR select NONE. The issue occurs because GraphEdgeScan and ReferenceScan functions fetch records directly from storage without routing them through Document::pluck select, thereby skipping the permission expression check. This impact is limited to the caller's current database, as namespace and database isolation remain intact.

Recommendations Update to version 3.1.0 or later. Remove select permissions on edge tables whose targets should remain hidden. Use namespace or database isolation as the primary security boundary where feasible.