SurrealDB releases from 3.1.0 up to before 3.3.0 contain an authorization bypass that allows an authenticated user who has delete permission on a referenced table to delete protected graph edges. Triggering a REFERENCE ON DELETE CASCADE removes edges even when the edge table’s PERMISSIONS FOR delete clause should deny the action. The flaw is a missing authorization check (CWE‑862) that can alter data integrity and potentially expose vulnerabilities in downstream applications depending on the graph structure.

The vulnerable versions are all SurrealDB products released before and including 3.2.x. Vendors and versions affected are SurrealDB, any release older than 3.3.0. No other subcomponents are noted as affected in the advisory.

The CVSS score of 5.3 rates the issue as moderate. Exploitation requires the attacker to be an authenticated user entitled to delete records in a referenced table; network exposure is not a prerequisite, so the attack vector is internal or application‑level. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower overall risk compared to high‑severity alerts. Nonetheless, the bypass permits unauthorized data deletion, which can impact confidentiality, integrity, and availability of the graph data.