CVE-2026-63755 Details

A permission bypass vulnerability has been identified in SurrealDB versions prior to 3.1.0. The issue arises because the database evaluates user-supplied WHERE clauses in SELECT statements, as well as certain UPDATE-related clauses, against full record data before applying the relevant permission checks. This flaw allows authenticated users, including those with Record and Scope roles, to read the complete contents of any table within their current database, circumventing table-level permission restrictions. While the most direct method of data exfiltration involves scripting functions, this vulnerability can also be exploited using SurrealQL's THROW statement and timing-based side channels, even without scripting. Notably, the vulnerability is limited to the attacker's active database and does not affect other databases or namespaces.

Users can update to SurrealDB version 3.1.0 or later, where this vulnerability has been patched. For those unable to update, it is recommended to disable scripting functions if not needed, limit query access for untrusted users, and use namespace or database isolation as the primary security boundary when possible.