SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause.

Withdrawn by the publisher.

Affected: crates.io: surrealdb

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-vjjx-rfw4-rmfc. This link is maintained to preserve external references.

## Original Description SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause.