SurrealDB versions 3.0.0 through 3.2.x expose a missing authentication check in the revoke RPC method. Low‑privileged or unauthenticated callers can request the revocation of other users’ refresh tokens without providing proof of possession. The attacker may first obtain grant identifiers through an ACCESS SHOW ALL operation when granted VIEWER permission or via leaked tokens, and then invoke the revoke RPC to invalidate those tokens, forcing affected users to re‑authenticate. This weakness compromises the integrity of the authentication system and can cause denial of service to legitimate users by making them repeatedly re‑authenticate.

Versions of SurrealDB prior to 3.3.0 are affected, specifically releases 3.0.0–3.2.x. Affected installations expose the RPC interface without enforcing authentication on the revoke method.

The CVSS base score of 5.3 indicates moderate severity. Attackers need only have network reach to the RPC endpoint and the ability to perform an ACCESS SHOW ALL query with VIEWER rights or possess leaked tokens; no privilege escalation is required. Because the exploit requires knowledge of grant identifiers, the attack surface is limited, but it remains exploitable in environments where the RPC interface is accessible to unauthenticated users or where database permissions are lax. The vulnerability is not listed in the CISA KEV catalog, and no EPSS data is available, so the exact likelihood of exploitation is uncertain but the exposure is definite in exposed deployments.