Privilege Escalation Vulnerability in SurrealDB Affects User Permissions

CVE-2026-63763

What is CVE-2026-63763?

SurrealDB versions prior to 2.5.0 and 3.0.0-beta.3 are susceptible to a privilege escalation vulnerability that allows unprivileged users, such as those assigned the database editor role, to manipulate fields containing futures, functions, or closures. These entities execute in the context of the calling user instead of their originator, enabling an attacker to embed malicious logic. When a higher-privileged user accesses these manipulated records, the malicious code executes under their permissions, potentially granting the attacker full control of the database, including the ability to create a root owner and seize control of the server. This scenario underscores the critical need for securing database roles and access to prevent unauthorized privilege elevation.

References