SurrealDB: Writes in a PERMISSIONS clause bypass table permissions — GHSA-66R2-5GWJ-GXM2

Summary

A `PERMISSIONS ... WHERE` clause is evaluated with permission enforcement disabled, so it can't recurse into its own checks. But the clause could also contain data-modifying statements, and these ran with enforcement still off — so evaluating a permission check could write to tables the caller cannot write. For example: ```surql DEFINE TABLE post PERMISSIONS FOR update WHERE (CREATE log SET at = time::now()) OR…

Timeline

Published by source

2026-09-04

Risk context

• Reported severity or threat level: medium.
• Reported CVSS score: 4.3 out of 10.
• Reported EPSS value: 0.00287.
• Review exposure for the affected product or family: rust: surrealdb-core.

Product

rust: surrealdb-core

What to do

General, cautious steps (verify details in the official source):

• Review exposure and plan remediation based on risk and environment.
• Identify affected product versions in your inventory and verify whether you are impacted.
• Apply vendor patches/updates or recommended mitigations as soon as available.
• Read the official advisory for exact affected versions and remediation steps.

Official advisory

• Read the official source
• CVE Record
• NVD

Evidence and provenance

Canonical advisory ID

GHSA-66R2-5GWJ-GXM2

Source

GitHub

Vendor

GitHub

Published by source

2026-09-04

Last source activity

2026-09-04

Additional identifiers

CVE-2026-63733

Curated by

hlukh.ch

Related advisories and connections

These advisories are connected by shared CVE, product, vendor, source, or time signals.