CVE-2026-63738

Analyzed Analyzed - Analysis Complete

SurrealDB Graph Traversal Field Permission Bypass

Publication date: 2026-07-20

Last updated on: 2026-07-22

Assigner: VulnCheck

Description

SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph traversals instead of direct table scans.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-22

Generated

2026-08-10

AI Q&A

2026-07-20

EPSS Evaluated

2026-08-09

NVD

CVE-2026-63738

EUVD

EUVD-2026-45909

Affected Vendors & Products

Vendor	Product	Version / Range
surrealdb	surrealdb	From 3.1.0 (inc) to 3.1.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

SurrealDB versions 3.1.0 to 3.1.4 have a flaw where field-level SELECT permissions are not enforced when records are accessed through graph traversals like edges or back-references. Attackers with basic table access can bypass field restrictions by using these traversals, exposing sensitive data that should be hidden.

Detection Guidance

Detecting this vulnerability requires checking SurrealDB versions and testing for field-level permission bypasses. Verify installed versions with 'surreal version' or check package managers. Test traversal queries to see if hidden fields are exposed by comparing direct table scans with graph-edge queries.

Impact Analysis

If you use SurrealDB 3.1.0-3.1.4 with field-level permissions, attackers with table access could read restricted fields by exploiting graph traversals. This could expose sensitive information like passwords or personal data without needing advanced privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data minimization and security principles or HIPAA's access controls. Organizations using affected versions may face compliance risks if sensitive fields are exposed.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.5 or later immediately. If upgrading is not possible, disable graph traversals or use the legacy executor as a temporary workaround. Avoid relying on field-level permissions for sensitive data until patched.

Hi! I’m here to help you understand CVE-2026-63738. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70