Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109333SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH

Medium 6.5

In plain English

A medium-severity missing authorization in surrealdb from surrealdb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 78.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known record id in a RETURN … FETCH query to read another tenant's data when table PERMISSIONS allow reads.

Affected products (as reported)

Vendor	Product	Versions
surrealdb	surrealdb	3.0.0 – before 3.3.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

GitHub Security Advisory (GHSA-3vw5-j55x-486h) vendor-advisory
VulnCheck Advisory: SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH third-party-advisory