CVE-2026-63746 Details
Description
SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause.
A vulnerability exists in SurrealDB versions prior to 3.1.0, where the database fails to properly enforce SELECT permissions on tables when navigating through graph edges or back-references. This allows authenticated users to access records from any table connected by graph edges, regardless of the table's defined SELECT permissions. The issue arises because the graph traversal functions retrieve records directly from storage without applying the necessary permission checks, enabling unauthorized access to sensitive information.
Users can upgrade to SurrealDB version 3.1.0 or later, where this vulnerability has been patched. For immediate needs, remove SELECT permissions on edge tables that should not expose their targets, or use database or namespace isolation as a primary boundary.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-vjjx-rfw4-rmfc | [email protected] | Vendor AdvisoryMitigation |
| https://www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-graph-traversal | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| surrealdb surrealdb | < 3.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |