CVE-2026-63740
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
SurrealDB before version 3.1.4 fails to properly enforce SELECT permissions on array elements (field.*) for record users. Attackers with record scope access can read array elements that should be hidden by element-level permissions.
Risk Assessment
Risk of data leakage from array elements that should be protected by element-level permissions.
Recommendation
Update SurrealDB to version 3.1.4 or later. Review permission configuration for array fields.
Other vulnerabilities in SurrealDB
See all- CVE-2026-63763High
Privilege escalation vulnerability in SurrealDB before 2.5.0 and 3.0.0-beta.3. Unprivileged users can create or modify fields containing futures, functions, or closures that execute in the context of a privileged user, leading to privilege escalation up to server takeover.
- CVE-2026-63762Medium
SurrealDB before version 2.6.1 (and before 3.0.0-beta.3) contains a denial of service vulnerability in the JavaScript engine. A user able to execute queries can construct a large string and pass it to compilation, causing a null pointer dereference and server crash.
- CVE-2026-63761Medium
SurrealDB before 3.1.0 silently substitutes ES512 with ES384 when JWT access is configured with ALGORITHM ES512, due to missing ES512 support in the jsonwebtoken crate v10.x. This causes curve mismatch (P-521 vs P-384) and authentication failures. The flaw cannot be used to forge tokens or compromise data confidentiality.
- CVE-2026-63760High
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.
- CVE-2026-63759Medium
SurrealDB before version 3.1.0 fails to enforce recursion depth limits in the type/kind parser. Authenticated attackers can send queries with deeply nested type annotations, exhausting server memory and crashing the process.
- CVE-2026-63758Medium
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement, allowing authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions without ownership verification.
- CVE-2026-63757High
Vulnerability in SurrealDB before version 3.1.0. The HTTP /rpc sessions method returns session UUIDs without authentication and accepts arbitrary session fields without ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.
- CVE-2026-63756High
Time-of-check/time-of-use race condition in SurrealDB before version 3.1.0 in the HTTP /rpc endpoint. Unauthenticated requests can inherit authenticated session state, allowing privilege hijacking.
- CVE-2026-63755Medium
SurrealDB before version 3.1.0 evaluates user-supplied WHERE clauses before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user can read the full contents of any table in the database, bypassing table-level permission checks. The vulnerability is confined to the current database.
- CVE-2026-63754Medium
In SurrealDB before 3.1.0, malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with select-only permissions can block writes for any user, including root.
Original NVD description (English source)
SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrect index handling during permission filtering.