Surrealdb 2.0.0 Before 3.3.1 Deny Funcs Capability Bypass Via Method Style Invocations

Back www.vulncheck.com

Surrealdb 2.0.0 Before 3.3.1 Deny Funcs Capability Bypass Via Method Style Invocations

www.vulncheck.com • November 3, 2026

Share: View original

SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations

surrealdb >= 2.0.0, = 2.0.0, < 3.3.1

CWE-284 Improper Access Control

GitHub Security Advisory (GHSA-p296-7pr4-87rr)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CVE-2026-121416: SurrealDB Deny Funcs Bypass Vulnerability Disclosed A vulnerability identified as CVE-2026-121416 affects SurrealDB versions 2.0.0 to 3.3.1, allowing authenticated users to bypass method-style function restrictions. This flaw arises from the MethodPart::evaluate function, which fails to enforce capability checks, enabling unauthorized access to sensitive functions like file bucket data manipulation. The risk is particularly high for internet-facing or multi-tenant database deployments where query access is broadly granted. Exploitation could lead to unauthorized data exposure or changes, but does not directly disrupt services. The vulnerability was published on November 3, 2026, with a CVSS score of 7.1, indicating a high severity. Remediation is advised through upgrading to the vendor-fixed release or restricting query access until a patch is applied. 1 sources 63

Extracted Entities

Platforms (2)

GitHub SurrealDB