Authentication Bypass Vulnerability in SurrealDB by SurrealDB Inc.

CVE-2026-63735

What is CVE-2026-63735?

SurrealDB versions prior to 3.2.0 are vulnerable to an authentication bypass issue due to improper validation of namespaces and database scopes in custom API routes. This flaw allows authenticated users to access and invoke endpoints across different namespaces or databases by manipulating the URL path. As a result, legitimate users can read sensitive data or execute unintended operations that could severely compromise data integrity and security across the platform.

References