CVE-2026-63740
Received Received - Intake

SurrealDB Array Element Permission Bypass Before 3.1.4

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrect index handling during permission filtering.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63740
EUVD
EUVD-2026-45911

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SurrealDB versions before 3.1.4. It allows attackers with record scope access to bypass SELECT permissions on array elements. The system fails to properly enforce permissions on individual array elements (field.*), leaking elements that should be hidden. This happens due to incorrect index handling during permission filtering.

Detection Guidance

To detect this vulnerability, check if your SurrealDB version is before 3.1.4. Use the command: surrealdb version. If the version is below 3.1.4, the system is vulnerable. Additionally, review database queries using field.* permissions to see if unauthorized array elements are exposed.

Impact Analysis

Attackers could read array elements that element-level permissions should deny. This compromises data confidentiality by exposing sensitive information within arrays that users are not authorized to access. The impact is limited to record users and does not affect root or record-owner sessions.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR and HIPAA by exposing unauthorized data. GDPR requires strict access controls and data confidentiality, while HIPAA mandates protecting sensitive health information. A breach of these controls may result in legal penalties and loss of trust.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.4 or later immediately. If upgrading is not possible, avoid using element-level permissions (field.*) for record users or restrict record users from selecting tables with such permissions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63740. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart