SurrealDB versions prior to 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back‑references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause. The weakness is a permission validation failure, classified as CWE‑200, resulting in the possibility of exposing sensitive data that should otherwise be protected.

The vulnerability affects SurrealDB, the NoSQL database product from the SurrealDB organization. All releases prior to 3.1.0 are impacted, including the 3.0.x series, while version 3.1.0 and later include the fix that enforces SELECT permissions during graph traversal.

The CVSS score of 7.1 indicates high severity, and the vulnerability is limited to authenticated users. Because the attacker only needs valid credentials and knowledge of a table reachable via a graph edge, the exploitation path is relatively straightforward. The EPSS score of < 1% indicates a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the combination of high impact and a low hurdle for attackers makes this a significant risk for deployments that expose sensitive tables to authenticated database users.