SurrealDB before version 2.1.4 contains a permission bypass that occurs when the DEFINE TABLE … OVERWRITE clause is used on tables defined with TYPE RELATION. The database silently ignores the permissions specified in the rewritten table definition, so an administrator who attempts to tighten access actually leaves the previous permissions in effect. Because the failure is silent, the administrator may incorrectly believe that the change has been applied, while a client authorized to run queries continues to see data that the updated permissions were meant to restrict. The weakness is an example of CWE‑276: Incorrect Privilege Assignment.

The vulnerability affects the SurrealDB product suite prior to version 2.1.4. All installations using the DEFINE TABLE … OVERWRITE syntax on relational tables are potentially impacted, regardless of platform.

The CVSS score of 2.3 indicates a low base severity, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. The likely attack path requires a client that already has query privileges; the attacker would attempt to tighten permissions using an overwrite operation, misinterpret the failure, and access data they should be denied from. No network or code‑execution vector is required beyond normal authorized query access.