CVE-2026-63748
Received Received - Intake

SurrealDB Information Disclosure via Error Messages

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw operand values in error responses, bypassing field-level access controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63748
EUVD
EUVD-2026-45919

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB versions before 3.1.0 have an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw operand values in error responses, bypassing access controls.

Detection Guidance

To detect this vulnerability, monitor SurrealDB error messages for exposed field values during arithmetic or extend operations. Check SurrealDB logs for error responses containing raw operand values from hidden fields. Ensure UPDATE permissions are not granted to users who should only have SELECT access.

Impact Analysis

This vulnerability allows unauthorized users to read sensitive data that should be restricted by field-level permissions. Attackers with UPDATE access could expose hidden field values through error messages, potentially leaking confidential information.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing sensitive personal or health information. Organizations may face legal penalties or reputational damage if such data is disclosed due to insufficient access controls.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.0 or later to patch the vulnerability. If upgrading is not possible, restrict UPDATE permissions to users who do not require field-level SELECT restrictions. Review and audit user permissions to ensure least privilege access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63748. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart