CVE-2026-109342
SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Method
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 12, 2026
- Updated
- Oct 15, 2026
- Reserved
- Oct 12, 2026
Description
SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attackers can obtain grant identifiers via ACCESS SHOW ALL with VIEWER permission or leaked tokens, then permanently revoke refresh tokens to force re-authentication.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 5.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
surrealdbsurrealdb |
|
References
- GitHub Security Advisory (GHSA-2jc3-58q7-mm2j)vendor-advisory
- VulnCheck Advisory: SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC Methodthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.