The vulnerability arises because SurrealDB does not sufficiently validate the owner of a user record when a scope user switches databases using the USE clause or the use method. As a result, an attacker who already holds an authenticated session can impersonate another user in a different database if both databases contain a user record with the same identifier. This allows the attacker to perform any action that the impersonated user is permitted to do, such as reading, modifying, or deleting data. The flaw is a classic authentication bypass, classified as CWE-287, and enables unauthorized access to data that should be protected by the $auth parameter.

This issue affects SurrealDB deployments running any version earlier than 1.5.4. The product is the SurrealDB database engine (surrealdb:surrealdb), and the vulnerability manifests in environments where a user record with a matching identifier exists across multiple databases.

The CVSS score of 5.3 denotes moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to first acquire a valid authenticated session on the SurrealDB instance, then issue a USE directive that points to a database containing a user record with the same identifier. Once the context switches, the attacker can act as that user, thereby accessing functionality that depends solely on the $auth token. The attack vector is therefore limited to authenticated users and does not involve remote code execution or privilege escalation from an unauthenticated state.