CVE-2026-63738
Received Received - Intake

SurrealDB Graph Traversal Field Permission Bypass

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph traversals instead of direct table scans.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63738
EUVD
EUVD-2026-45909

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
surrealdb surrealdb to 3.1.5 (exc)
surrealdb surrealdb to 3.0.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB versions 3.1.0 to 3.1.4 have a flaw where field-level SELECT permissions are not enforced when records are accessed through graph traversals like edges or back-references. Attackers with basic table access can bypass field restrictions by using these traversals, exposing sensitive data that should be hidden.

Detection Guidance

Detecting this vulnerability requires checking SurrealDB versions and testing for field-level permission bypasses. Verify installed versions with 'surreal version' or check package managers. Test traversal queries to see if hidden fields are exposed by comparing direct table scans with graph-edge queries.

Impact Analysis

If you use SurrealDB 3.1.0-3.1.4 with field-level permissions, attackers with table access could read restricted fields by exploiting graph traversals. This could expose sensitive information like passwords or personal data without needing advanced privileges.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data minimization and security principles or HIPAA's access controls. Organizations using affected versions may face compliance risks if sensitive fields are exposed.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.5 or later immediately. If upgrading is not possible, disable graph traversals or use the legacy executor as a temporary workaround. Avoid relying on field-level permissions for sensitive data until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63738. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart