CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 3.2.0 are vulnerable to a permissions bypass that allows attackers to execute data-modifying statements within PERMISSIONS clauses without enforcement. This flaw enables unauthorized write operations to tables, leading to potential data corruption and integrity issues. Organizations using SurrealDB should prioritize patching this vulnerability to safeguard their data integrity and prevent unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.
Related CVEs
Other vulnerabilities affecting the same vendor(s)