GHSA-wp87-mgvq-5j93: SurrealDB USE NS/DB Implicit Creation Bypasses Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wp87-mgvq-5j93",
  "modified" : "2026-07-01T20:21:25Z",
  "published" : "2026-07-01T20:21:25Z",
  "aliases" : [ ],
  "summary" : "SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization",
  "details" : "An anonymous caller could create new namespaces and databases on a running SurrealDB instance without holding `DEFINE NAMESPACE` or `DEFINE DATABASE` permission.\n\n`USE NS <name>` and `USE DB <name>` automatically create the target when it does not exist. The three places `USE` is handled — the RPC `use` method, `Datastore::process_use`, and the SurrealQL executor — did not check whether the caller was allowed to create the resource. Under default capabilities any session reached this path, including an unauthenticated guest.\n\n### Impact\n\nWhat an attacker **can** do:\n\n- Create new namespaces and databases without `DEFINE NAMESPACE` / `DEFINE DATABASE` permission. An unauthenticated guest is enough under default capabilities.\n- Recreate a parent namespace that an operator deliberately dropped, using a stale namespace-Editor token, by running `USE NS <dropped> DB anything`.\n- Exhaust catalog storage by repeatedly creating new resources.\n\nWhat it **can't** do:\n\n- Read or modify data inside any pre-existing namespace or database.\n- Escalate to root or namespace-owner privileges on existing resources.\n- Affect deployments running with `auth_enabled=false`.\n\n### Patches\n\nAll three `USE` entry points now check whether the caller has `DEFINE NAMESPACE` / `DEFINE DATABASE` authority before creating a missing target. Sessions still update their context regardless of authorization, so SDKs that send `use` before `signin` continue to work — only the catalog creation step is gated. The parent-namespace side-effect path is closed by the same check.\n\nVersions 3.1.0 and later are not affected.\n\n### Workarounds\n\n- Set `--deny-arbitrary-query *` for guest principals to remove the entry point.\n- Run with `--auth` and require all callers to `signin` before issuing `use`.\n- Revoke namespace-level tokens promptly when a namespace is dropped.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "crates.io",
      "name" : "surrealdb"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "3.1.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-wp87-mgvq-5j93"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/surrealdb/surrealdb/commit/f3ee3bd55533c14f1fa3e69ce18fc8904c1ce3f9"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/surrealdb/surrealdb"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-862", "CWE-863" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-07-01T20:21:25Z",
    "nvd_published_at" : null
  }
}