SurrealDB Graph Edge Permission Bypass Before 3.1.0

Executive Summary

CVE-2026-63746 is a permission bypass vulnerability in SurrealDB versions before 3.1.0. It allows authenticated users with SELECT permissions on a table to read records from any table reachable through graph edges or back-references, even if the target table has SELECT permissions set to NONE. The issue occurs because graph traversal operations fetch records without checking the target table's SELECT permissions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your SurrealDB version is below 3.1.0. Use the command 'surreal version' to verify the installed version. If the version is older than 3.1.0, the system is vulnerable. Additionally, review graph edge configurations and table permissions to identify potential exposure paths.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive data. Attackers with valid credentials could read records from restricted tables by traversing graph edges, potentially exposing confidential information. The impact is limited to confidentiality, as namespace and database isolation remain unaffected.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements for GDPR and HIPAA by allowing unauthorized access to sensitive personal or health data. Organizations using affected SurrealDB versions may face increased risk of data breaches, leading to potential legal and financial penalties under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade SurrealDB to version 3.1.0 or later to patch the vulnerability. As a temporary workaround, restrict SELECT permissions on edge tables or rely on namespace and database isolation to limit exposure. Monitor for unauthorized access attempts during the transition period.

Useful 0 Not Useful 0