https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 02:36:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-341481 EUVD-2026-341481 https://cve.radiocsirt.org/vuln/euvd-2026-341481 https://cve.radiocsirt.org/vuln/fkie_cve-2026-63746 <p>SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table&#39;s PERMISSIONS FOR select clause.</p> <p>SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table&#39;s PERMISSIONS FOR select clause.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-63746 https://cve.radiocsirt.org/vuln/ghsa-vjjx-rfw4-rmfc <p><strong>Affected:</strong> crates.io: surrealdb</p> <p>An authenticated record or scope user could read records on any table reachable through a graph edge or `REFERENCES TO` back-reference, regardless of that table&#39;s `PERMISSIONS FOR select` clause.</p> <p>Traversing `SELECT * FROM source-&gt;edge-&gt;target` returned full documents from `target` even when `target` was defined as `PERMISSIONS FOR select NONE`. The same bypass extended through multi-hop chains, so any table reachable by a sequence of edges from a readable starting point was exposed.</p> <p>The root cause: `GraphEdgeScan` and `ReferenceScan` fetched records straight from storage without routing them through `Document::pluck_select`, so the target table&#39;s permission expression was never consulted.</p> <p>### Impact</p> <p>An authenticated record or scope user can read records on any table reachable through a chain of graph edges or back-references from a table they have `select` on, regardless of the target&#39;s `PERMISSIONS FOR select` clause. Confidentiality-only and bounded to the caller&#39;s current database — namespace and database isolation are unaffected.</p> <p>### Patches</p> <p>A new per-batch permission cache (`exec::permission::CachedTableSelect`) resolves each target table&#39;s `SELECT` permission once and filters yielded values through `check_permission_for_value`, matching the regular `SELECT` code path.</p> <p>- Versions 3.1.0 and later are not affected.</p> <p>### Workarounds</p> <p>- Remove `select` permission on edge tables whose targets should be hidden. - Use namespace or database isolation as the primary bound…</p> <p><strong>Affected:</strong> crates.io: surrealdb</p> <p>An authenticated record or scope user could read records on any table reachable through a graph edge or `REFERENCES TO` back-reference, regardless of that table&#39;s `PERMISSIONS FOR select` clause.</p> <p>Traversing `SELECT * FROM source-&gt;edge-&gt;target` returned full documents from `target` even when `target` was defined as `PERMISSIONS FOR select NONE`. The same bypass extended through multi-hop chains, so any table reachable by a sequence of edges from a readable starting point was exposed.</p> <p>The root cause: `GraphEdgeScan` and `ReferenceScan` fetched records straight from storage without routing them through `Document::pluck_select`, so the target table&#39;s permission expression was never consulted.</p> <p>### Impact</p> <p>An authenticated record or scope user can read records on any table reachable through a chain of graph edges or back-references from a table they have `select` on, regardless of the target&#39;s `PERMISSIONS FOR select` clause. Confidentiality-only and bounded to the caller&#39;s current database — namespace and database isolation are unaffected.</p> <p>### Patches</p> <p>A new per-batch permission cache (`exec::permission::CachedTableSelect`) resolves each target table&#39;s `SELECT` permission once and filters yielded values through `check_permission_for_value`, matching the regular `SELECT` code path.</p> <p>- Versions 3.1.0 and later are not affected.</p> <p>### Workarounds</p> <p>- Remove `select` permission on edge tables whose targets should be hidden. - Use namespace or database isolation as the primary bound…</p> https://cve.radiocsirt.org/vuln/ghsa-vjjx-rfw4-rmfc