SurrealDB versions before 3.3.0 contain an authorization bypass in the HTTP session creation routine. The authentication routine checks credentials against Surreal-Auth-NS and Surreal-Auth-DB headers, but the session is built using Surreal-NS and Surreal-DB headers without validating that the user is permitted to access the chosen namespace and database. This flaw allows an authenticated user to impersonate a member of another tenant and read, create, or modify records that belong to that tenant, effectively elevating privileges across tenant boundaries.

The affected product is SurrealDB from the SurrealDB vendor. All releases prior to 3.3.0, including the publicly available 3.2.4 build, are vulnerable. No specific operating system or deployment configuration is required beyond running a vulnerable version of SurrealDB exposed to HTTP clients.

The vulnerability is scored as CVSS 8.6, indicating high severity. EPSS data is not available, so the exact likelihood of exploitation cannot be quantified; however, the flaw is exploitable over the network via HTTP header manipulation and does not require special privileges beyond valid authentication. The issue is not listed in the CISA KEV catalog, suggesting no publicly known active exploitation at the time of assessment. Attackers who can send crafted HTTP requests to the application can leverage the unauthorized tenant selection to gain access to sensitive data.