SurrealDB versions prior to 3.1.0 suffer an authorization bypass in the RELATE statement, permitting users who hold only CREATE permissions to overwrite edge records that require UPDATE rights. The exploit allows the attacker to silently replace the contents of an existing edge, silently removing or altering data integrity without the user’s awareness. This weakness is classified as CWE‑285 and can compromise the confidentiality and integrity of stored relationships.

Vendor SurrealDB, product SurrealDB, affected releases are all versions before 3.1.0. Any instance running an unpatched release is vulnerable.

The CVSS score of 5.3 indicates a moderate risk. The EPSS score of < 1% shows that the probability of exploitation is very low. This vulnerability is not listed in CISA’s KEV catalog. An authenticated attacker with only CREATE permissions can issue a RELATE statement that includes a SET id clause pointing to an existing edge id; the storage engine will silently overwrite the target record without validating UPDATE rights, allowing unauthorized data modification.