The vulnerability is an authorization bypass in SurrealDB that permits an authenticated user to read records from other namespaces or databases. By using the FETCH clause in a RETURN … FETCH query, a user can target a known record ID within a foreign namespace/database and retrieve its contents if the table permits read access. This flaw enables an attacker to gain access to confidential data belonging to other tenants, exposing the system to a confidentiality breach. The flaw is rooted in broken access control (CWE-862).

SurrealDB is affected from version 3.0.0 up to, but not including, version 3.3.0. The issue impacts all installations of SurrealDB whose database schema includes multiple namespaces or databases where user permissions are configured. Any environment using SurrealDB 3.0.0 through 3.2.xx is vulnerable unless mitigated.

The CVSS score of 7.1 indicates a moderate to high severity. The EPSS score is not available, so the likely exploitation probability is unknown, but the vulnerability requires authentication and permission to read data. Since the flaw is not currently listed in the CISA KEV catalog, there is no known active exploitation, but the issue can be leveraged by any attacker who has legitimate credentials or can compromise a user account. The attack vector is an authenticated request; an attacker must successfully log in as a record user and then execute a specially crafted RETURN … FETCH query to read data from a foreign tenant. Given the impact on confidentiality and the existence of permissions that allow cross‑namespace reads, the risk for environments with permissive table permissions is significant.