CVE-2026-109343CWE-639

CVE-2026-109343

High · published October 12, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
16.5
In the wild
Unconfirmed
What it is

SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows in tables whose PERMISSIONS allow it, such as PERMISSIONS FULL.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
8.6 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00258 · 16.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-10-12T21:17Z
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-2v9j-645m-pcrq · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-cross-tenant-access-via-use-statement · [email protected]
EPSS history
Timeline
  • 14 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 12 OCT 16:05Z
    SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement
    cvelistv5
  • 12 OCT 16:05Z
    SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement
    cvelistv5