An authorization bypass vulnerability in SurrealDB allows authenticated users to access or manipulate data via user-controlled keys, posing a high risk to data confidentiality and integrity.

This vulnerability involves an authorization bypass through user-controlled keys. An authenticated attacker can manipulate these keys to perform operations on data records they should not have access to, potentially leading to unauthorized data disclosure or modification.

The ability for an authenticated user to bypass authorization controls threatens the confidentiality and integrity of the database. Given the CVSS score of 8.1, this represents a high-severity risk, particularly in multi-tenant or shared database environments where strict data isolation is required.

Immediate Action: Upgrade to SurrealDB version 3.2.0 or later to patch the authorization bypass flaw.

Proactive Monitoring: Audit database access logs for unusual patterns of record access or modifications that originate from low-privileged user accounts.

Compensating Controls: If immediate patching is not feasible, restrict API access to trusted networks and ensure that database-level permissions are as restrictive as possible for all users.

Public Exploit Available: No (exploit_available: false)

SurrealDB users should apply the 3.2.0 update as soon as possible. Addressing authorization bypass flaws is vital to preventing unauthorized data access within the database environment.