SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. The vulnerability lies in its Document::purge_edges routine in surrealdb/core/src/doc/delete.rs. Prior to version 3.1.0, when a node is deleted, this routine automatically removes associated graph edge records that have their permissions disabled via opt.clone().with_perms(false). That removal bypasses the edge table’s PERMISSIONS FOR delete and PERMISSIONS FOR select clauses, allowing an attacker who can delete a node to erase related edges without proper authorization. This unexpected permission bypass can corrupt or expose relationships in the database and was fixed in version 3.1.0.

The affected product is SurrealDB, the scalable document‑graph database from surrealdb:surrealdb. Versions prior to 3.1.0 are impacted. Any deployment using a pre‑3.1.0 release is susceptible.

The CVSS score of 5.4 indicates a medium severity vulnerability. The EPSS value is less than 1 %, suggesting a very low likelihood of exploitation in the wild at this time. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is a capable attacker issuing a delete query against a node in the database. Attackers would need to execute a delete operation on a node, implying a local or privileged attacker with access to the database. The exploitation path therefore requires the ability to issue node‑deletion queries, after which the delete permissions for connected edges are bypassed.