CVE-2026-63751 Details
Description
SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including those restricted by field-level SELECT permissions, into attacker-chosen destination fields.
A field-level permission bypass vulnerability has been identified in SurrealDB versions prior to 3.1.0. This vulnerability allows authenticated users to read protected fields by exploiting JSON Patch operations. Attackers can use the UPDATE PATCH command with an empty 'from' pointer in 'copy' or 'move' operations to duplicate all fields of a record, including those restricted by field-level SELECT permissions, into destination fields of their choice.
Users should update to SurrealDB version 3.1.0 or later, where this vulnerability has been patched. For those unable to update, it is recommended to restrict UPDATE PATCH operations to users who already have SELECT permission on all fields of the target record. Alternatively, the mutation can be changed to an explicit SET or MERGE clause, which does not allow JSON Patch operations.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-fpxg-5xmv-922m | [email protected] | Vendor AdvisoryMitigation |
| https://www.vulncheck.com/advisories/surrealdb-before-field-permission-bypass-via-json-patch | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| surrealdb surrealdb | < 3.1.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |