Database Permission Bypass in SurrealDB by SurrealDB Inc.

CVE-2026-63755

What is CVE-2026-63755?

SurrealDB versions prior to 3.1.0 are vulnerable to a permission bypass issue that occurs due to improper evaluation of user-supplied WHERE clauses in SELECT statements, as well as in various update commands. This flaw allows authenticated users, including Record and Scope users, to access complete table data, breaching table-level permission checks. The risk is accentuated when scripting functions are enabled, but access is also achievable through SurrealQL's THROW statement. Importantly, the vulnerability is restricted to the attacker's own database context and does not extend beyond established namespace or database separations.

References