CVE-2026-63755
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
SurrealDB before version 3.1.0 evaluates user-supplied WHERE clauses before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user can read the full contents of any table in the database, bypassing table-level permission checks. The vulnerability is confined to the current database.
Risk Assessment
Authenticated users, including Record and Scope users, can gain unauthorized access to all data in the database, posing a serious confidentiality breach.
Recommendation
Upgrade SurrealDB to version 3.1.0 or later, which includes a fix for this vulnerability.
Other vulnerabilities in SurrealDB
See all- CVE-2026-63763High
Privilege escalation vulnerability in SurrealDB before 2.5.0 and 3.0.0-beta.3. Unprivileged users can create or modify fields containing futures, functions, or closures that execute in the context of a privileged user, leading to privilege escalation up to server takeover.
- CVE-2026-63762Medium
SurrealDB before version 2.6.1 (and before 3.0.0-beta.3) contains a denial of service vulnerability in the JavaScript engine. A user able to execute queries can construct a large string and pass it to compilation, causing a null pointer dereference and server crash.
- CVE-2026-63761Medium
SurrealDB before 3.1.0 silently substitutes ES512 with ES384 when JWT access is configured with ALGORITHM ES512, due to missing ES512 support in the jsonwebtoken crate v10.x. This causes curve mismatch (P-521 vs P-384) and authentication failures. The flaw cannot be used to forge tokens or compromise data confidentiality.
- CVE-2026-63760High
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.
- CVE-2026-63759Medium
SurrealDB before version 3.1.0 fails to enforce recursion depth limits in the type/kind parser. Authenticated attackers can send queries with deeply nested type annotations, exhausting server memory and crashing the process.
- CVE-2026-63758Medium
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement, allowing authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions without ownership verification.
- CVE-2026-63757High
Vulnerability in SurrealDB before version 3.1.0. The HTTP /rpc sessions method returns session UUIDs without authentication and accepts arbitrary session fields without ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.
- CVE-2026-63756High
Time-of-check/time-of-use race condition in SurrealDB before version 3.1.0 in the HTTP /rpc endpoint. Unauthenticated requests can inherit authenticated session state, allowing privilege hijacking.
- CVE-2026-63754Medium
In SurrealDB before 3.1.0, malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with select-only permissions can block writes for any user, including root.
- CVE-2026-63753Medium
Vulnerability in SurrealDB before version 3.1.0. Authentication state is not refreshed in LIVE SELECT subscriptions after session changes. Attackers can continue receiving real-time notifications after session expiry or revocation.
Original NVD description (English source)
SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements) against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user — including Record and Scope users — can exploit this ordering flaw to read the full contents of any table in the database they are authenticated against, bypassing table-level permission checks. Exfiltration is most direct when scripting functions are enabled (--allow-scripting), but is also possible via SurrealQL's THROW statement and timing-based side channels without scripting. The vulnerability is confined to the attacker's current database and does not cross namespace or database isolation boundaries.