https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 01:35:53 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-102876 <p>SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant&#39;s namespace and database to read, create, and modify records across tenant boundaries.</p> <p>SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant&#39;s namespace and database to read, create, and modify records across tenant boundaries.</p> https://db.gcve.eu/vuln/fkie_cve-2026-102876 https://db.gcve.eu/vuln/ghsa-xjq6-rqgg-x5j7 <p>SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant&#39;s namespace and database to read, create, and modify records across tenant boundaries.</p> <p>SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant&#39;s namespace and database to read, create, and modify records across tenant boundaries.</p> https://db.gcve.eu/vuln/ghsa-xjq6-rqgg-x5j7