{"answers":{"affected":"2 open source packages ship an affected version, including surrealdb.","exploited":"There is no known exploitation of GHSA-f82j-v89j-mf86 in the wild and no public exploit code.","fix":"Upgrade surrealdb to 3.1.0 or later.","what":"GHSA-f82j-v89j-mf86 is a missing authorization vulnerability in surrealdb, published on 1 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-f82j-v89j-mf86 and fix it if it is affected.\n\nWhat it is: GHSA-f82j-v89j-mf86 is a missing authorization vulnerability in surrealdb, published on 1 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-f82j-v89j-mf86 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- surrealdb (crates.io): affected all versions; fixed in 3.1.0\n- surrealdb (crates.io): affected all versions; fixed in 3.1.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-f82j-v89j-mf86/ (Markdown: https://insights.sbomify.com/GHSA-f82j-v89j-mf86/index.md)","id":"GHSA-f82j-v89j-mf86","markdown":"https://insights.sbomify.com/GHSA-f82j-v89j-mf86/index.md","name":"GHSA-f82j-v89j-mf86","record":{"aliases":[],"analysis":{"component_type":"database","fix_type":"upgrade","impacts":["data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"SurrealDB database","requires_auth":"low_privilege","summary":"Authenticated users with CREATE permission can overwrite existing edge records without UPDATE permission by specifying an existing ID in RELATE statements.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"`RELATE` creates an edge record between two existing records, and SurrealDB enforces the `CREATE` permission on the edge table for this operation. When the statement included a `SET id = edge:existing` clause, however, the new edge's id ended up pointing at an record that was already in storage. Rather than failing because the target already existed — which is what a create operation should do — the storage layer silently overwrote the existing edge. A caller with `CREATE` permission could therefore replace any existing edge on the table, even without `UPDATE` permission for that record.\n\n### Impact\n\nAn authenticated user with `CREATE` permission on an edge table could overwrite any existing record on that table — including edges they had no `UPDATE` permission for — by issuing a `RELATE` whose `SET id = …` resolved to the target record's id. The attack is integrity-only.\n\n### Patches\n\nA patch has been introduced that adds an explicit `Statement::Relate` arm using `put_record` instead of `set_record` when the create path is selected. Conflicting writes now return a `RecordExists` error.\n\n- Versions 3.1.0 and later are not affected by this issue.\n\nThis is a behaviour change for applications that relied on RELATE … SET id = … to silently replace existing edges; after the patch those calls return RecordExists instead. Applications that need \"create or replace\" semantics should use UPSERT (which is correctly permission-gated for the update half).\n\n### Workarounds\n\nThe defect only fires when the `RELATE` statement includes a `SET id = …` clause that resolves to an existing edge id. Applications that let SurrealDB auto-generate the edge id (the default — `RELATE a:1 -\u003e edge -\u003e b:1 SET \u003cdata\u003e` with no `id` override) are not affected, because auto-generated ids do not collide with existing records.\n\nWhere applications must use `SET id = …` (for example, to produce deterministic edge ids for idempotency), they should first verify that no record with the target id exists before issuing the statement, or restrict `CREATE` permission on the edge table to principals trusted with `UPDATE` on the same table.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission","id":"GHSA-f82j-v89j-mf86","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["3.1.0"],"introduced":["0"],"last_affected":[],"package":"surrealdb","purl":null,"source":"GHSA-f82j-v89j-mf86"},{"ecosystem":"crates.io","fixed":["3.1.0"],"introduced":["0"],"last_affected":[],"package":"surrealdb","purl":"pkg:cargo/surrealdb","source":"GHSA-f82j-v89j-mf86"}],"products":null,"published":"2026-07-01","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Authenticated users with CREATE permission can overwrite existing edge records without UPDATE permission by specifying an existing ID in RELATE statements.","url":"https://insights.sbomify.com/GHSA-f82j-v89j-mf86/"}