CVE-2026-63733

A `PERMISSIONS ... WHERE` clause is evaluated with permission enforcement disabled, so it can't recurse into its own checks. But the clause could also contain data-modifying statements, and these ran with enforcement still off — so evaluating a permission check could write to tables the caller cannot write. For example: ```surql DEFINE TABLE post PERMISSIONS FOR update WHERE (CREATE log SET at = time::now()) OR true; ``` Any user allowed to update a `post` now also creates a `log` record,