SurrealDB releases before 3.1.0 contain a flaw in the permission logic for the USE NS and USE DB statements. When the server processes these commands it does not enforce DEFINE NAMESPACE or DEFINE DATABASE permissions. An attacker who sends requests to the RPC interface without authenticating can therefore issue USE commands that create arbitrary namespaces and databases. This bypasses the authentication and authorization checks that would normally prevent such operations, allowing the attacker to create isolated data stores and subsequently perform queries or further modifications. The flaw is captured by the CWE‑862 "Incorrect Authorization" weakness.

All publicly accessible instances of SurrealDB produced by the vendor surrealdb:surrealdb and running a version earlier than 3.1.0 are impacted. The issue is limited to the SurrealQL executor and the underlying RPC use mechanism for namespace and database selection. Clients that have any RPC connectivity to a vulnerable instance could exploit this vulnerability.

The measured CVSS score of 6.9 marks this bug as a moderate‑severity vulnerability. Its EPSS score is reported as less than 1%, indicating a very low yet non‑zero probability of exploitation. The issue is not listed in the CISA KEV catalog. Based on the description, the most likely attack vector is a remote, unauthenticated client that can connect to the RPC or SurrealQL endpoint; if network access to these interfaces is unenforced, exploitation is essentially trivial. The vulnerability does not depend on privileged system access or local execution, making it an easily launchable remote exploitation scenario.