CVE-2026-63763
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk19th percentile - higher than 19% of all known CVEs
Summary
Privilege escalation vulnerability in SurrealDB before 2.5.0 and 3.0.0-beta.3. Unprivileged users can create or modify fields containing futures, functions, or closures that execute in the context of a privileged user, leading to privilege escalation up to server takeover.
Risk Assessment
The attack can lead to full takeover of the SurrealDB database, including creation of a root account and server takeover, enabling theft or modification of all data.
Recommendation
Upgrade SurrealDB to version 2.5.0 or later (for 2.x branch) or 3.0.0-beta.3 or later (for 3.x branch).
Other vulnerabilities in SurrealDB
See all- CVE-2026-63762Medium
SurrealDB before version 2.6.1 (and before 3.0.0-beta.3) contains a denial of service vulnerability in the JavaScript engine. A user able to execute queries can construct a large string and pass it to compilation, causing a null pointer dereference and server crash.
- CVE-2026-63761Medium
SurrealDB before 3.1.0 silently substitutes ES512 with ES384 when JWT access is configured with ALGORITHM ES512, due to missing ES512 support in the jsonwebtoken crate v10.x. This causes curve mismatch (P-521 vs P-384) and authentication failures. The flaw cannot be used to forge tokens or compromise data confidentiality.
- CVE-2026-63760High
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the process.
- CVE-2026-63759Medium
SurrealDB before version 3.1.0 fails to enforce recursion depth limits in the type/kind parser. Authenticated attackers can send queries with deeply nested type annotations, exhausting server memory and crashing the process.
- CVE-2026-63758Medium
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement, allowing authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions without ownership verification.
- CVE-2026-63757High
Vulnerability in SurrealDB before version 3.1.0. The HTTP /rpc sessions method returns session UUIDs without authentication and accepts arbitrary session fields without ownership verification. Unauthenticated attackers can enumerate session UUIDs and impersonate authenticated sessions to read, write, delete data and escalate privileges.
- CVE-2026-63756High
Time-of-check/time-of-use race condition in SurrealDB before version 3.1.0 in the HTTP /rpc endpoint. Unauthenticated requests can inherit authenticated session state, allowing privilege hijacking.
- CVE-2026-63755Medium
SurrealDB before version 3.1.0 evaluates user-supplied WHERE clauses before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user can read the full contents of any table in the database, bypassing table-level permission checks. The vulnerability is confined to the current database.
- CVE-2026-63754Medium
In SurrealDB before 3.1.0, malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with select-only permissions can block writes for any user, including root.
- CVE-2026-63753Medium
Vulnerability in SurrealDB before version 3.1.0. Authentication state is not refreshed in LIVE SELECT subscriptions after session changes. Attackers can continue receiving real-time notifications after session expiry or revocation.
Original NVD description (English source)
SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database editor role) can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the invoking/querying user rather than their creator, an attacker can plant malicious logic that executes with a higher-privileged user's permissions when that user reads or writes the affected record. This can lead to full privilege escalation, including creation of a root owner and server takeover.