GHSA-98fx-66cf-fc7c: SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level
(updated )
A vulnerability was discovered where the user-supplied WHERE clause in a SELECT statement is evaluated against the full record data before PERMISSIONS FOR SELECT WHERE determines whether the principal is authorised to access that record. A side-effecting expression in the WHERE clause can exfiltrate record contents before the permission check runs. The same ordering bug affects the SET, MERGE, CONTENT and PATCH clauses of update-variant statements (UPDATE, UPSERT-update, INSERT ON DUPLICATE KEY UPDATE, RELATE-update).
This vulnerability is confined to the attacker’s current database. It does not cross namespace or database isolation boundaries.
References
- github.com/advisories/GHSA-98fx-66cf-fc7c
- github.com/surrealdb/surrealdb/commit/500f4060349580b9cbb9c07b8112a487551c4616
- github.com/surrealdb/surrealdb/security/advisories/GHSA-98fx-66cf-fc7c
- nvd.nist.gov/vuln/detail/CVE-2026-63755
- www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-where-clause
Code Behaviors & Features
Detect and mitigate GHSA-98fx-66cf-fc7c with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →