A vulnerability in SurrealDB allows an authenticated user to modify the composite record-id field by writing to body fields, which bypasses permission checks that rely on id components such as tenant isolation. The weakness is an authorization bypass (CWE‑639) and can grant an attacker access to data belonging to other tenants, effectively elevating privileges within the database. The impact is the compromise of confidentiality and integrity of protected data for users who are not intended to have access.

SurrealDB versions before 3.1.0 are affected. Any deployment of the database product from the vendor surrealdb is potentially vulnerable if it runs a pre‑3.1.0 release.

The CVSS score of 5.3 indicates that the vulnerability has moderate severity. The EPSS score of < 1% indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. The likely attack vector is an authenticated API request that writes to editable body fields; once authenticated, an attacker can set those fields to spoof the composite record-id used in permission checks, thereby bypassing tenant isolation and other access controls. The impact is therefore privilege escalation and unauthorized data access within the database environment.