SurrealDB Authorization Bypass via REFERENCE ON DELETE CASCADE

Executive Summary

CVE-2026-109340 is an authorization bypass in SurrealDB versions 3.1.0 to 3.2.x. It allows authenticated users with delete permissions on a referenced table to delete protected graph edges via the REFERENCE ON DELETE CASCADE feature. Normally, edge deletions should respect PERMISSIONS FOR delete clauses, but the cascade operation bypasses these checks during edge cleanup, enabling silent data loss.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check the SurrealDB version running on your system. Run: surreal version. If the output shows a version between 3.1.0 and 3.2.9, your system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with delete permissions on one table to delete protected edge records in another table, causing unintended data loss. It does not enable reading deleted edges or privilege escalation beyond the affected tables. The impact is limited to unauthorized deletion of edges despite permission restrictions.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade SurrealDB to version 3.3.0 or later immediately. If upgrading is not possible, restrict delete permissions on cascade target tables or avoid using REFERENCE ON DELETE CASCADE in edge scenarios.

Useful 0 Not Useful 0