CVE-2026-49997
Received Received - Intake

Privilege Escalation in SurrealDB Prior to 3.1.0

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description
SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in surrealdb/core/src/doc/delete.rs automatically removed graph edge records with permissions disabled through opt.clone().with_perms(false) when a connected node was deleted, bypassing the edge table's PERMISSIONS FOR delete and PERMISSIONS FOR select clauses. This issue is fixed in version 3.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-07-15
AI Q&A
2026-07-15
EPSS Evaluated
N/A
NVD
CVE-2026-49997
EUVD
EUVD-2026-44713

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
surrealdb surrealdb 3.1.0
surrealdb surrealdb From 3.1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in SurrealDB (CVE-2026-49997) allows a user with delete permissions for a node to bypass edge table permissions when deleting connected nodes. The Document::purge_edges function removes graph edges with permissions disabled, ignoring PERMISSIONS FOR delete and PERMISSIONS FOR select clauses on the edge table. This lets attackers delete edges they shouldn't have access to or view edge contents that should be hidden.

Impact Analysis

An attacker with delete permissions for a node could delete unauthorized edges connected to it or view sensitive edge data that should be restricted. This could lead to data leaks, unauthorized modifications to relationships between records, or bypassing intended access controls in the database.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized access to or deletion of sensitive data relationships. GDPR requires strict data access controls, while HIPAA mandates protection of health information. Bypassing edge permissions may result in unauthorized data exposure or modification, potentially leading to regulatory violations.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.0 or later to patch the vulnerability. Alternatively, restrict node delete permissions or use namespace isolation for multi-tenant separation as temporary workarounds.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-49997. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart