CVE-2026-63735
Received Received - Intake

SurrealDB Custom API Route Scope Validation Bypass

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by specifying the target scope in the URL path, reading sensitive data or triggering unintended operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63735
EUVD
EUVD-2026-45906

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes. This allows authenticated users to access endpoints in other tenants by manipulating the URL path to specify a different scope. Attackers with valid credentials for one namespace can read sensitive data or trigger unintended operations in other namespaces or databases.

Detection Guidance

To detect this vulnerability, check if your SurrealDB version is below 3.2.0. Run the command: surrealdb version. If the output shows a version less than 3.2.0, the system is vulnerable. Additionally, review custom API routes for improper namespace/database scope validation by examining URL paths for unauthorized scope overrides.

Impact Analysis

If you use SurrealDB versions before 3.2.0, an attacker with valid credentials for one namespace could access data or perform actions in another namespace or database. This could lead to unauthorized data exposure, data manipulation, or unintended operations affecting other tenants on the same instance.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. It may result in data breaches, non-compliance with data protection regulations, and potential legal consequences due to unauthorized data exposure or modification.

Mitigation Strategies

Immediately upgrade SurrealDB to version 3.2.0 or later. If upgrading is not possible, disable the custom API HTTP route or treat separate deployments as tenant isolation boundaries. Replace PERMISSIONS FULL with PERMISSIONS WHERE clauses in custom API routes to restrict access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63735. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart