CVE-2026-109342: SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method
SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attackers can obtain grant identifiers via ACCESS SHOW ALL with VIEWER permission or leaked tokens, then permanently revoke refresh tokens to force re-authentication.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
SurrealDB versions from 3.0.0 up to, but not including, 3.3.0 are affected. An attacker must be able to invoke the revoke RPC method and obtain a target grant identifier.
How could an attacker obtain grant identifiers?
A caller with VIEWER permission can obtain grant identifiers through ACCESS SHOW ALL. Identifiers may also be obtained from leaked tokens.
What is the practical impact of exploitation?
An attacker can revoke other users' refresh tokens without proof of possession. This permanently invalidates those tokens and forces the affected users to authenticate again.
What should be prioritized if immediate remediation is not possible?
Restrict access to the revoke RPC method and limit who has VIEWER permission, since VIEWER access can expose grant identifiers through ACCESS SHOW ALL. Investigate and contain leaked tokens, which can also provide the identifiers needed for revocation.