GHSA-f82j-v89j-mf86: SurrealDB: `RELATE` overwrites existing edge records without `UPDATE` permission
RELATE creates an edge record between two existing records, and SurrealDB enforces the CREATE permission on the edge table for this operation. When the statement included a SET id = edge:existing clause, however, the new edge’s id ended up pointing at an record that was already in storage. Rather than failing because the target already existed — which is what a create operation should do — the storage layer silently overwrote the existing edge. A caller with CREATE permission could therefore replace any existing edge on the table, even without UPDATE permission for that record.
References
Code Behaviors & Features
Detect and mitigate GHSA-f82j-v89j-mf86 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →