CVE-2026-63733
Received Received - Intake

SurrealDB Permissions Bypass Leading to Data Corruption

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63733
EUVD
EUVD-2026-45904

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB versions before 3.2.0 have a permissions bypass flaw where data-modifying statements in PERMISSIONS clauses execute without proper enforcement. Attackers with permission to perform a guarded operation can embed CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause to write to tables they lack permission for, causing unintended writes and data corruption.

Detection Guidance

Check SurrealDB version with command: surreal version. If version is below 3.2.0, the system is vulnerable. Review PERMISSIONS clauses in schema definitions for embedded CREATE, UPDATE, DELETE, or UPSERT statements.

Impact Analysis

This vulnerability allows attackers with limited permissions to write to unauthorized tables, leading to unintended data modifications and potential corruption. It could cause cascading effects within the database but cannot escape the attacker's namespace or perform root-level actions.

Compliance Impact

This vulnerability could lead to unauthorized data modifications, violating integrity requirements in GDPR and HIPAA. It may result in unauthorized access or tampering with sensitive data, posing compliance risks for data protection regulations.

Mitigation Strategies

Upgrade SurrealDB to version 3.2.0 or later. Remove all write operations (CREATE, UPDATE, DELETE, UPSERT) from PERMISSIONS clauses. Restrict schema definition permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63733. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart