CVE-2026-109340: SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE

Q: Who can exploit this issue?

An authenticated user needs delete permission on a referenced table. They can then delete a record that triggers a REFERENCE ON DELETE CASCADE operation.

Q: Are edge-table delete permissions sufficient to prevent the deletion?

No. During cascade-driven edge cleanup, permission checks for deleting the graph edges are disabled, so an edge table's PERMISSIONS FOR delete clause does not prevent the affected deletion path.

Q: Which deployments are affected?

SurrealDB versions from 3.1.0 up to, but not including, 3.3.0 are affected. Exposure requires use of REFERENCE ON DELETE CASCADE and graph edges whose deletion is intended to be restricted by permissions.

Q: What is the available remediation?

Upgrade SurrealDB to version 3.3.0 or later. No alternative mitigation is provided in the available data.

Published Oct 12, 2026

Updated

SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced table can delete a record whose cascade disables permission checks for edge cleanup, erasing edges despite the edge table's PERMISSIONS FOR delete clause.

Affected Software

1 affected component

SurrealDB SurrealDB>=3.1.0<3.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SurrealDB to a version that resolves this vulnerability.
Fixed in 3.3.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user needs delete permission on a referenced table. They can then delete a record that triggers a REFERENCE ON DELETE CASCADE operation.

Are edge-table delete permissions sufficient to prevent the deletion?

No. During cascade-driven edge cleanup, permission checks for deleting the graph edges are disabled, so an edge table's PERMISSIONS FOR delete clause does not prevent the affected deletion path.

Which deployments are affected?

SurrealDB versions from 3.1.0 up to, but not including, 3.3.0 are affected. Exposure requires use of REFERENCE ON DELETE CASCADE and graph edges whose deletion is intended to be restricted by permissions.

What is the available remediation?

Upgrade SurrealDB to version 3.3.0 or later. No alternative mitigation is provided in the available data.

CVE-2026-109340: SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Are edge-table delete permissions sufficient to prevent the deletion?

Which deployments are affected?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are edge-table delete permissions sufficient to prevent the deletion?

Which deployments are affected?

What is the available remediation?