The SurrealDB database server before version 3.3.0 contains a permission enforcement flaw in the SurrealQL USE statement. The statement allows a client to switch the session namespace and database to any target without verifying the caller’s authenticated privilege level. As a result, users who have been granted namespace, database, or record level access can elevate their access to a different tenant and read, create, update, or delete data in tables that expose broad permissions such as PERMISSIONS FULL. This flaw can lead to confidential data exposure, data integrity violations, and unauthorized data manipulation across tenants.

The affected product is SurrealDB, the open‑source database engine. All releases prior to 3.3.0 are vulnerable. Any deployment using a pre‑3.3.0 build is at risk.

The CVSS score of 8.6 places the issue in the high severity category, indicating significant impact once exploited. Because EPSS data is not available, the likelihood of current exploitation is unknown, and the vulnerability is not yet listed in the CISA KEV catalog. In a multi‑tenant environment where tenants share a single database instance, any authenticated user with even limited privilege can abuse the USE statement to gain read, write, or delete capabilities on other tenants’ data. If an attacker can obtain valid credentials or trick an application into executing a USE statement, the exploitation path is straightforward: connect, authenticate, issue an arbitrary USE to a target namespace, then perform data operations within that tenant. Given the broad permission models available, the potential for data loss or leakage is considerable.