CVE-2026-63745 Details
Description
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-named body fields to spoofed values that permission checks incorrectly read instead of the immutable id key.
A vulnerability allowing authorization bypass has been identified in SurrealDB versions prior to 3.1.0. This issue arises because authenticated users can manipulate composite record ID values by writing to editable body fields. As a result, attackers can circumvent permission rules that rely on ID components, such as tenant isolation, by injecting spoofed values into body fields. The permission checks erroneously read these values instead of the immutable ID keys, allowing unauthorized access to restricted records.
Users can upgrade to SurrealDB version 3.1.0 or later, where this vulnerability has been patched. For those unable to upgrade, it is recommended to avoid permission expressions that reference 'id.<field>' on Object-keyed record IDs, and instead use the full record ID or a server-derived session value. Additionally, UNIQUE indexes on 'id.<field>' should be avoided until version 3.1.0 is installed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6vg3-hgrw-p5gf | [email protected] | Vendor AdvisoryMitigation |
| https://www.vulncheck.com/advisories/surrealdb-before-authorization-bypass-via-composite-record-id | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| surrealdb surrealdb | < 3.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |