SurrealDB GHSA-4w65-7h3j-p29h: REFERENCE ON DELETE CASCADE Authorization Bypass

Vulnerability Overview Vulnerability Name: REFERENCE ON DELETE CASCADE bypasses an edge table's PERMISSIONS FOR delete Vulnerability ID: GHSA-4w65-7h3j-p29h Severity: Medium (3.4 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: Low - Availability: Low CVE ID: No known CVE Weakness: CWE-862 Reporter: Yanhaoxi Description When a record is deleted, SurrealDB removes the graph edges connected to it. This edge removal is intended to run with the caller's permissions, meaning the clause should still apply—deleting endpoint vertices should not allow the deletion of edges unless the caller can delete them directly. Another way to bypass this guarantee is , which deletes the referencing record when the referenced record is deleted, and computes a cascade with permissions disabled. This is intentional because referential integrity can be enforced independently of the caller's potential actions on the referenced record. However, permission enforcement is a single-frame-wide flag, so the disabled state leaks into the edge cleanup of the referencing record itself. If the referencing record is also an edge endpoint, its edges are subsequently removed without consulting the edge table's clause. The result is a cross-table authorization bypass: a caller with delete permissions on one table can erase edge records in another table where is denied, reaching the endpoint via . Impact This affects deployments combining with cases where the referencing record is also a graph edge endpoint, and the edge restrictions use the clause. What an attacker can do: Use permissions limited to deleting endpoint vertices to cause protected edge records to be deleted in the edge table, where their clauses deny access, when the deletion is routed through . Cause silent, unrecoverable loss of edge records, which may carry business data. What an attacker cannot do: Read the contents of deleted edges—this is an integrity issue, not a disclosure. Delete records on tables that the caller cannot access through such cascades or across namespace or database isolation boundaries. Escalate to namespace or root-level privileges. System users (root, namespace, database owners) are governed by their roles, are unaffected by this flag, and remain unaffected. Remediation Permission context is now separated, so the referential integrity bypass no longer reaches the edge cascade. still disables permissions for the deletion of the referencing record itself, but the cleanup of the record's edges runs in the caller's actual permission state, ensuring the edge table's clause is evaluated accurately. If the caller is not allowed to delete, the edges are left in place. Versions 3.3.0 and later are not affected by this issue. Workarounds Users unable to patch should consider the following workarounds: Restrict vertex permissions on tables acting as reference cascade targets to users trusted to delete all connected edge records. Avoid using where the referencing record is also a graph edge endpoint, and the edge table relies on . Use namespace or database isolation as the primary boundary for edge-level . References SurrealQL Documentation — DEFINE FIELD SurrealQL Documentation — Record references SurrealQL Documentation — DEFINE TABLE — PERMISSIONS SurrealQL Documentation — RELATE statement Fix(doc): keep the reference-CASCADE permission bypass out of the edge cascade (Included in SurrealDB 3.3.0) Acknowledgments Thanks to Yanhaoxi for reporting this issue.

Goal Reached Thanks to every supporter — we hit 100%!

SurrealDB GHSA-4w65-7h3j-p29h: REFERENCE ON DELETE CASCADE Authorization Bypass

More from this source