SurrealDB versions before 2.5.0 and before 3.0.0‑beta.3 suffer a confused deputy privilege escalation bug. Unprivileged users with the database editor role can insert or alter fields that contain futures, functions, or closures. These constructs are executed in the context of the user who reads or writes the record, not the user who created them, allowing malicious code to run with higher‑privileged rights. An attacker can therefore promote themselves to a root owner or even take over the server, compromising confidentiality, integrity, and availability.

The vulnerability affects SurrealDB instances of any version prior to 2.5.0 and prior to 3.0.0‑beta.3. Users running these versions, regardless of deployment size or environment, are susceptible if they grant editor roles with field update permissions.

The CVSS score of 7.5 places this flaw in the High severity range. The EPSS score of < 1% indicates a very low but non‑zero probability of exploitation, but the ability to execute arbitrary code at the privileges of a higher‑level user indicates a potentially lethal exploitation vector. The likely attack technique involves creating malicious future expressions from an editor account and later triggering them when a privileged user accesses or modifies the affected record.