CVE-2026-109340 in SurrealDB
Summary
by MITRE • 10/12/2026
SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permission checks for edge cleanup, erasing edges despite the edge table's PERMISSIONS FOR delete clause.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in SurrealDB versions prior to 3.3.0 represents a critical authorization bypass within the database engine’s graph data management subsystem. This flaw specifically targets the mechanism handling referential integrity and cascading operations, allowing authenticated users with specific permissions on referenced tables to execute unauthorized actions against protected edge records. The core of the issue lies in how the database processes DELETE CASCADE operations when they involve foreign key constraints defined as REFERENCE ON DELETE CASCADE. In a properly secured system, permission checks for deleting an edge should be enforced independently based on the access control policies applied directly to the edge table itself. However, due to this implementation flaw, the cascade operation effectively bypasses these direct permissions, creating a significant gap in the database's security model that undermines the principle of least privilege and granular access control.
Technically, the vulnerability arises from an incorrect sequencing or omission of permission validation during the execution of cascading deletions. When a user with delete privileges on a primary record initiates a deletion, SurrealDB triggers the associated cascade rules to maintain referential integrity by removing related records in other tables, such as graph edges. In this specific scenario, the database engine fails to verify whether the initiating user has explicit DELETE permissions for the edge table before proceeding with the cleanup of those edges. Consequently, even if the PERMISSIONS FOR delete clause on the edge table is configured to restrict access or deny deletion entirely, the cascade mechanism overrides these restrictions. This allows an attacker who possesses only basic write privileges on a referenced node record to indirectly cause the destruction of protected graph structures without ever being granted direct permission to modify those edges.
The operational impact of this vulnerability is severe for applications relying on SurrealDB for complex relationship modeling and access-controlled data storage. Graph databases are frequently used in scenarios where edge integrity is as critical as node integrity, such as in financial transaction networks, social media connections, or supply chain tracking systems. By enabling the unauthorized deletion of protected edges, an attacker can corrupt the logical structure of the graph, leading to data inconsistency and potential application failures. Furthermore, this bypass allows for a denial-of-service condition by systematically removing critical relationship records that other parts of the application depend on for functionality. The ability to erase security-critical metadata or relationships without proper authorization also poses a risk to audit trails and forensic analysis capabilities within the organization's infrastructure.
This vulnerability aligns with CWE-269, which describes Improper Privilege Management, as it involves an actor obtaining privileges they were not explicitly granted through a logical flaw in permission enforcement. It is also closely related to CWE-732, concerning Incorrect Permission Assignment for Critical Resource, because the edge table's security configuration was effectively ignored during the cascade operation. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior can be categorized under T1564.008, Hidden Files and Directories, or more accurately under privilege escalation techniques where an attacker leverages system mechanisms to bypass intended restrictions. The attack vector is remote if SurrealDB is exposed over a network with authentication enabled, making it particularly dangerous in cloud-native environments where database services are often publicly accessible behind firewalls but rely on internal access controls for data protection.
To mitigate this vulnerability, organizations running SurrealDB must immediately upgrade to version 3.3.0 or later, which contains the necessary patches to enforce permission checks correctly during cascade operations. Until an upgrade is feasible, administrators should consider restricting delete permissions on referenced tables to only highly privileged service accounts that do not interact directly with end-user applications. Additionally, implementing application-level validation can provide a secondary layer of defense by ensuring that deletion requests are validated against expected graph structures before being sent to the database. Regular auditing of access control policies and monitoring for unusual patterns in edge deletions can also help detect potential exploitation attempts early. It is crucial to review all existing cascade configurations to ensure they do not inadvertently expose other tables or resources to similar bypass risks, thereby hardening the overall security posture of the data layer.