{"answers":{"affected":"2 open source packages ship an affected version, including surrealdb.","exploited":"There is no known exploitation of GHSA-wp87-mgvq-5j93 in the wild and no public exploit code.","fix":"Upgrade surrealdb to 3.1.0 or later.","what":"GHSA-wp87-mgvq-5j93 is a missing authorization vulnerability in surrealdb, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-wp87-mgvq-5j93 and fix it if it is affected.\n\nWhat it is: GHSA-wp87-mgvq-5j93 is a missing authorization vulnerability in surrealdb, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-wp87-mgvq-5j93 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- surrealdb (crates.io): affected all versions; fixed in 3.1.0\n- surrealdb (crates.io): affected all versions; fixed in 3.1.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-wp87-mgvq-5j93/ (Markdown: https://insights.sbomify.com/GHSA-wp87-mgvq-5j93/index.md)","id":"GHSA-wp87-mgvq-5j93","markdown":"https://insights.sbomify.com/GHSA-wp87-mgvq-5j93/index.md","name":"GHSA-wp87-mgvq-5j93","record":{"aliases":[],"analysis":{"component_type":"database","fix_type":"upgrade","impacts":["data_modify","denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"SurrealDB database","requires_auth":"none","summary":"Unauthenticated attackers can create new namespaces and databases in SurrealDB, bypassing authorization checks and potentially exhausting storage resources.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"An anonymous caller could create new namespaces and databases on a running SurrealDB instance without holding `DEFINE NAMESPACE` or `DEFINE DATABASE` permission.\n\n`USE NS \u003cname\u003e` and `USE DB \u003cname\u003e` automatically create the target when it does not exist. The three places `USE` is handled — the RPC `use` method, `Datastore::process_use`, and the SurrealQL executor — did not check whether the caller was allowed to create the resource. Under default capabilities any session reached this path, including an unauthenticated guest.\n\n### Impact\n\nWhat an attacker **can** do:\n\n- Create new namespaces and databases without `DEFINE NAMESPACE` / `DEFINE DATABASE` permission. An unauthenticated guest is enough under default capabilities.\n- Recreate a parent namespace that an operator deliberately dropped, using a stale namespace-Editor token, by running `USE NS \u003cdropped\u003e DB anything`.\n- Exhaust catalog storage by repeatedly creating new resources.\n\nWhat it **can't** do:\n\n- Read or modify data inside any pre-existing namespace or database.\n- Escalate to root or namespace-owner privileges on existing resources.\n- Affect deployments running with `auth_enabled=false`.\n\n### Patches\n\nAll three `USE` entry points now check whether the caller has `DEFINE NAMESPACE` / `DEFINE DATABASE` authority before creating a missing target. Sessions still update their context regardless of authorization, so SDKs that send `use` before `signin` continue to work — only the catalog creation step is gated. The parent-namespace side-effect path is closed by the same check.\n\nVersions 3.1.0 and later are not affected.\n\n### Workarounds\n\n- Set `--deny-arbitrary-query *` for guest principals to remove the entry point.\n- Run with `--auth` and require all callers to `signin` before issuing `use`.\n- Revoke namespace-level tokens promptly when a namespace is dropped.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization","id":"GHSA-wp87-mgvq-5j93","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"missing_authorization","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["3.1.0"],"introduced":["0"],"last_affected":[],"package":"surrealdb","purl":null,"source":"GHSA-wp87-mgvq-5j93"},{"ecosystem":"crates.io","fixed":["3.1.0"],"introduced":["0"],"last_affected":[],"package":"surrealdb","purl":"pkg:cargo/surrealdb","source":"GHSA-wp87-mgvq-5j93"}],"products":null,"published":"2026-07-01","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Unauthenticated attackers can create new namespaces and databases in SurrealDB, bypassing authorization checks and potentially exhausting storage resources.","url":"https://insights.sbomify.com/GHSA-wp87-mgvq-5j93/"}