https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 21:27:20 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-338892 EUVD-2026-338892 https://cve.radiocsirt.org/vuln/euvd-2026-338892 https://cve.radiocsirt.org/vuln/fkie_cve-2026-49997 <p>SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in surrealdb/core/src/doc/delete.rs automatically removed graph edge records with permissions disabled through opt.clone().with_perms(false) when a connected node was deleted, bypassing the edge table&#39;s PERMISSIONS FOR delete and PERMISSIONS FOR select clauses. This issue is fixed in version 3.1.0.</p> <p>SurrealDB is a scalable, distributed, collaborative, document-graph database for the realtime web. Prior to 3.1.0, Document::purge_edges in surrealdb/core/src/doc/delete.rs automatically removed graph edge records with permissions disabled through opt.clone().with_perms(false) when a connected node was deleted, bypassing the edge table&#39;s PERMISSIONS FOR delete and PERMISSIONS FOR select clauses. This issue is fixed in version 3.1.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-49997 https://cve.radiocsirt.org/vuln/ghsa-whwg-vh4f-pmmf <p><strong>Affected:</strong> crates.io: surrealdb</p> <p>In SurrealDB, records can be connected as a graph: a `RELATE` statement creates an edge record between two node records. If either endpoint node is deleted, SurrealDB automatically removes the edge row to keep the graph consistent.</p> <p>A user with permission to delete a node could also delete the edges connected to that node, even when the edge table&#39;s `PERMISSIONS FOR delete` clause should have stopped them.</p> <p>The automatic edge removal (`Document::purge_edges`) ran with permissions disabled (`opt.clone().with_perms(false)`), so the edge table&#39;s `PERMISSIONS FOR delete` and `PERMISSIONS FOR select` clauses were never consulted. The removal step could also observe edge state that the edge&#39;s SELECT clause should have hidden.</p> <p>### Impact</p> <p>What an attacker **can** do:</p> <p>- Delete any edge connected to a node they can delete, regardless of the edge table&#39;s `PERMISSIONS FOR delete` clause. - Observe edge contents that `PERMISSIONS FOR select` should have hidden, as a side effect of the same edge-removal step.</p> <p>What it **can&#39;t** do:</p> <p>- Delete nodes on tables they do not hold `DELETE` on (the edge removal only runs from an authorised node delete). - Cross namespace or database isolation boundaries. - Escalate to root or operator-level privileges.</p> <p>### Patches</p> <p>`Document::purge_edges` now propagates the caller&#39;s permission context into the edge removal. Each connected edge `DELETE` is evaluated against the edge table&#39;s `PERMISSIONS FOR delete` clause, matching a direct `DELETE`.</p> <p>Versions…</p> <p><strong>Affected:</strong> crates.io: surrealdb</p> <p>In SurrealDB, records can be connected as a graph: a `RELATE` statement creates an edge record between two node records. If either endpoint node is deleted, SurrealDB automatically removes the edge row to keep the graph consistent.</p> <p>A user with permission to delete a node could also delete the edges connected to that node, even when the edge table&#39;s `PERMISSIONS FOR delete` clause should have stopped them.</p> <p>The automatic edge removal (`Document::purge_edges`) ran with permissions disabled (`opt.clone().with_perms(false)`), so the edge table&#39;s `PERMISSIONS FOR delete` and `PERMISSIONS FOR select` clauses were never consulted. The removal step could also observe edge state that the edge&#39;s SELECT clause should have hidden.</p> <p>### Impact</p> <p>What an attacker **can** do:</p> <p>- Delete any edge connected to a node they can delete, regardless of the edge table&#39;s `PERMISSIONS FOR delete` clause. - Observe edge contents that `PERMISSIONS FOR select` should have hidden, as a side effect of the same edge-removal step.</p> <p>What it **can&#39;t** do:</p> <p>- Delete nodes on tables they do not hold `DELETE` on (the edge removal only runs from an authorised node delete). - Cross namespace or database isolation boundaries. - Escalate to root or operator-level privileges.</p> <p>### Patches</p> <p>`Document::purge_edges` now propagates the caller&#39;s permission context into the edge removal. Each connected edge `DELETE` is evaluated against the edge table&#39;s `PERMISSIONS FOR delete` clause, matching a direct `DELETE`.</p> <p>Versions…</p> https://cve.radiocsirt.org/vuln/ghsa-whwg-vh4f-pmmf