CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 3.1.0 have a vulnerability in the Document::purge_edges function that allows unauthorized deletion of graph edge records due to improper permission checks when connected nodes are removed. This could lead to data integrity issues and unauthorized access to sensitive information. Users of SurrealDB, particularly those managing sensitive or collaborative data, should prioritize upgrading to version 3.1.0 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in surrealdb/core/src/doc/delete.rs automatically removed graph edge records with permissions disabled through opt.clone().with_perms(false) when a connected node was deleted, bypassing the edge table's PERMISSIONS FOR delete and PERMISSIONS FOR select clauses. This issue is fixed in version 3.1.0.