Description
SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by specifying the target scope in the URL path, reading sensitive data or triggering unintended operations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| surrealdb | surrealdb | < 3.2.0 | 3.2.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | surrealdb | < 3.2.0 | 3.2.0 | GHSA-848m-r628-vrxw |
References
- GitHub Security Advisory (GHSA-848m-r628-vrxw) vendor-advisory
- VulnCheck Advisory: SurrealDB before 3.2.0 Authentication Bypass via Custom API third-party-advisory