{"id":"GHSA-vjjx-rfw4-rmfc","revision":"c320096206444379b302e49d19abb554","records":[{"revision":"c320096206444379b302e49d19abb554","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-vjjx-rfw4-rmfc","aliases":["CVE-2026-63746"],"title":"SurrealDB: Graph traversal bypasses table SELECT permissions","description":"An authenticated record or scope user could read records on any table reachable through a graph edge or `REFERENCES TO` back-reference, regardless of that table's `PERMISSIONS FOR select` clause.\n\nTraversing `SELECT * FROM source->edge->target` returned full documents from `target` even when `target` was defined as `PERMISSIONS FOR select NONE`. The same bypass extended through multi-hop chains, so any table reachable by a sequence of edges from a readable starting point was exposed.\n\nThe root cause: `GraphEdgeScan` and `ReferenceScan` fetched records straight from storage without routing them through `Document::pluck_select`, so the target table's permission expression was never consulted.\n\n### Impact\n\nAn authenticated record or scope user can read records on any table reachable through a chain of graph edges or back-references from a table they have `select` on, regardless of the target's `PERMISSIONS FOR select` clause. Confidentiality-only and bounded to the caller's current database — namespace and database isolation are unaffected.\n\n### Patches\n\nA new per-batch permission cache (`exec::permission::CachedTableSelect`) resolves each target table's `SELECT` permission once and filters yielded values through `check_permission_for_value`, matching the regular `SELECT` code path.\n\n- Versions 3.1.0 and later are not affected.\n\n### Workarounds\n\n- Remove `select` permission on edge tables whose targets should be hidden.\n- Use namespace or database isolation as the primary boundary where feasible.","state":0,"publishedAt":"2026-07-01T20:10:34+00:00","modifiedAt":"2026-09-04T20:40:32.992781+00:00","affected":[{"ecosystem":"crates.io","name":"surrealdb","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.1.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-vjjx-rfw4-rmfc","https://nvd.nist.gov/vuln/detail/CVE-2026-63746","https://github.com/surrealdb/surrealdb","https://www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-graph-traversal"],"sourceUrl":"https://github.com/advisories/GHSA-vjjx-rfw4-rmfc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vjjx-rfw4-rmfc","identifiers":["GHSA-vjjx-rfw4-rmfc","CVE-2026-63746"]},"retained":false,"historicalAffected":[]}],"coverage":[]}