SurrealDB versions before 3.2.0 allow an attacker with permission to perform a guarded operation to embed data‑modifying statements such as CREATE, UPDATE, DELETE, or UPSERT inside a PERMISSIONS clause. The embedded statements are executed with enforcement disabled, enabling the attacker to write to tables for which they had no prior write privileges and potentially corrupting data. This weakness is a missing access control flaw (CWE‑863).

SurrealDB products before version 3.2.0 from the vendor surrealdb are affected.

The vulnerability carries a CVSS score of 5.3, indicating moderate severity. EPSS score is < 1%, indicating a very low likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. An attacker only needs the ability to perform a guarded operation; from that foothold they can bypass permission checks and write to unauthorized tables. The risk is therefore low to moderate for environments with strict permission controls but can be substantial if permissive guarded operations exist.