CVE-2026-63733 Details
Description
SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.
A permissions bypass vulnerability has been identified in SurrealDB versions prior to 3.2.0. This vulnerability allows data-modifying statements within PERMISSIONS clauses to execute without proper enforcement. As a result, attackers with permission to perform certain operations can write to tables they would normally be restricted from, by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause. This exploitation can lead to unintended data modifications and corruption.
Users can update to SurrealDB version 3.2.0 or later, where this vulnerability has been patched. Those unable to update should review their PERMISSIONS clauses and remove any that contain data-modifying statements. Additionally, it is advisable to limit who can define schema and vet imported data, as such clauses must be defined before they can be triggered.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-66r2-5gwj-gxm2 | [email protected] | Vendor AdvisoryMitigation |
| https://www.vulncheck.com/advisories/surrealdb-before-permissions-bypass-via-permissions-clause | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| surrealdb surrealdb | < 3.2.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |