CVE-2026-49997 Details
Description
SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in surrealdb/core/src/doc/delete.rs automatically removed graph edge records with permissions disabled through opt.clone().with_perms(false) when a connected node was deleted, bypassing the edge table's PERMISSIONS FOR delete and PERMISSIONS FOR select clauses. This issue is fixed in version 3.1.0.
A vulnerability in SurrealDB prior to version 3.1.0 allows for the unauthorized deletion of graph edge records and access to restricted edge data. This issue arises because the edge removal process bypasses the edge table's permission checks, automatically deleting edges when a connected node is removed, without considering the edge's delete permissions. As a result, edges can be deleted and their contents accessed, even when permissions should prevent such actions.
Users can update to SurrealDB version 3.1.0 or later, where this vulnerability is fixed. For those unable to update, it is recommended to restrict delete permissions on nodes to trusted principals and to use namespace or database isolation as a primary boundary for multi-tenant separation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 15, 2026CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/commit/500f4060349580b9cbb9c07b8112a487551c4616 | [email protected] | Source CodeVendor |
| https://github.com/surrealdb/surrealdb/releases/tag/v3.1.0 | [email protected] | Release NotesVendor |
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-whwg-vh4f-pmmf | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-285 | Improper Authorization | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| SurrealDB | < 3.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | New CVE Received | [email protected] |