CVE-2026-49997: SurrealDB: Edge PERMISSIONS FOR delete bypassed when a connected node is deleted

In SurrealDB, records can be connected as a graph: a RELATE statement creates an edge record between two node records. If either endpoint node is deleted, SurrealDB automatically removes the edge row to keep the graph consistent.

A user with permission to delete a node could also delete the edges connected to that node, even when the edge table’s PERMISSIONS FOR delete clause should have stopped them.

The automatic edge removal (Document::purge_edges) ran with permissions disabled (opt.clone().with_perms(false)), so the edge table’s PERMISSIONS FOR delete and PERMISSIONS FOR select clauses were never consulted. The removal step could also observe edge state that the edge’s SELECT clause should have hidden.