GHSA-3f6w-45q9-v69m

Duplicate Advisory: Custom API route lets authenticated callers override namespace/database scope via URL path

Published

2026-07-20

Modified

2026-09-04

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-848m-r628-vrxw. This link is maintained to preserve external references. ## Original Description SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by specifying the target scope in the URL path, reading sensitive data or triggering unintended operations.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-3f6w-45q9-v69m