CVE-2026-63735: SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

An authenticated user scoped to one namespace/database could invoke a custom API (DEFINE API) belonging to a different namespace/database, reaching another tenant’s endpoint.

The route /api/{namespace}/{database}/{endpoint} took the namespace and database from the URL and applied them to the caller’s session before the endpoint was looked up or run, without checking that the caller’s authenticated scope covered them. Because a custom API handler runs with permissions disabled (definer’s rights), the endpoint’s own PERMISSIONS clause was the only gate — open to everyone for a PERMISSIONS FULL endpoint. The api::invoke() function was affected the same way, resolving against the session’s selected namespace/database (settable via the surreal-ns / surreal-db headers or USE).