GHSA-4q5r-gwcx-24m9

Duplicate Advisory: SurrealDB: Graph traversal bypasses table SELECT permissions

Published

2026-07-20

Modified

2026-09-04

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vjjx-rfw4-rmfc. This link is maintained to preserve external references. ## Original Description SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-4q5r-gwcx-24m9