SurrealDB before version 1.0.1 misconfigures the default permissions for newly created tables, granting full access—SELECT, CREATE, UPDATE, and DELETE—to any user who can reach the database. This privilege escalation flaw (CWE‑276) permits attackers to read, alter, or delete data in tables that were intended to be protected. Because the vulnerability exists at the database engine level, an adversary can influence all tables created after the service starts, potentially compromising the confidentiality, integrity, and availability of the application’s data.

The affected product is SurrealDB in all releases before 1.0.1. Users who have deployed a publicly exposed or otherwise uncontrolled instance of SurrealDB may find that their database tables inherit FULL permissions by default unless they explicitly configure access controls. The issue is not limited to a specific minor revision; any build lacking the patch has the same default permission behaviour.

The CVSS base score is 8.7, indicating a high severity level, while the EPSS score is below 1%, suggesting that active exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it by obtaining any level of database access, including unauthenticated connections on publicly exposed instances, and by simply executing standard SQL commands. Because the flaw resides in default configuration, it does not require exploitation of additional logic or privileged code execution beyond normal database operations.