CVE-2026-63738 Details
Description
SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph traversals instead of direct table scans.
A vulnerability exists in SurrealDB versions 3.1.0 prior to 3.1.5, where field-level SELECT permissions are not properly enforced when records are accessed through graph-edge or back-reference traversals. This allows attackers with table-level SELECT access to read field values that should be hidden by permissions, by traversing records through graphs instead of direct table scans.
Users can upgrade to SurrealDB version 3.1.5 or later, where this vulnerability has been patched. Alternatively, field-level SELECT permissions can be enforced at the table level, and the legacy executor can be used with the ' --planner-strategy compute-only' option.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-hv6h-hc26-q48p | [email protected] | Vendor AdvisoryMitigation |
| https://www.vulncheck.com/advisories/surrealdb-before-field-permission-bypass-via-traversal | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| surrealdb surrealdb | >= 3.1.0, < 3.1.5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |