Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-109340 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permission checks for edge cleanup, erasing edges despite the edge table's PERMISSIONS FOR delete clause.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:4.3 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CNA: [email protected]CVSS-B:5.4 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-4w65-7h3j-p29h	[email protected]	AdvisoryRemedyVendor
https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-authorization-bypass-via-reference-on-delete-cascade	[email protected]	Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-862	Missing Authorization	[email protected]

Affected Products

Product	Versions
SurrealDB	>= 3.1.0, < 3.3.0 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 3.3.0moderate effort Workaround:low effort Restrict vertex DELETE permission on tables that are reference-cascade targets to principals trusted to delete all connected edge records. Workaround:low effort Avoid REFERENCE ON DELETE CASCADE where the referencing record is also a graph-edge endpoint whose edge table relies on PERMISSIONS FOR delete. Mitigation:low effort Use namespace or database isolation as the primary boundary where edge-level PERMISSIONS is load-bearing.

Product

Versions

SurrealDB

>= 3.1.0, < 3.3.0 (semver)

CPE

No CPEs found in CPE dictionary for this product.

Remediation

Upgrade: 3.3.0moderate effort
Workaround:low effort
Restrict vertex DELETE permission on tables that are reference-cascade targets to principals trusted to delete all connected edge records.
Workaround:low effort
Avoid REFERENCE ON DELETE CASCADE where the referencing record is also a graph-edge endpoint whose edge table relies on PERMISSIONS FOR delete.
Mitigation:low effort
Use namespace or database isolation as the primary boundary where edge-level PERMISSIONS is load-bearing.

Change History

2 change records found show changes

Date	Action	Recorded By
Oct 13, 2026	CVE Modified	CISA-ADP
Oct 12, 2026	New CVE Received	[email protected]