CVE-2026-63749
Received Received - Intake

SurrealDB Authentication Bypass via LIVE SELECT Parameter Injection

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $before, $after, or $event are evaluated against attacker-controlled bindings instead of actual documents. Authenticated subscribers can bind chosen values to these parameter names and register LIVE SELECT queries to receive notifications for records that SELECT permission expressions should have hidden.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63749
EUVD
EUVD-2026-45920

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB versions before 3.1.0 have an authentication bypass in LIVE SELECT subscriptions. Attackers with valid credentials can manipulate permission expressions by binding chosen values to variables like $value, $before, $after, or $event. This tricks the system into evaluating permissions against attacker-controlled data instead of actual documents, allowing access to records that should be hidden.

Detection Guidance

To detect this vulnerability, check SurrealDB versions before 3.1.0 by running: surrealdb version. If the version is below 3.1.0, the system is vulnerable. Monitor LIVE SELECT queries for unusual subscriptions using $value, $before, $after, or $event bindings.

Impact Analysis

If you use SurrealDB versions before 3.1.0, an attacker with valid credentials could exploit this to read sensitive records they shouldn't have access to. This could lead to unauthorized data exposure, data leaks, or information disclosure within your database.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information). It may result in data breaches, legal penalties, and loss of trust due to improper access controls.

Mitigation Strategies

Immediately upgrade SurrealDB to version 3.1.0 or later. If upgrading is not possible, avoid using user-named variables in table permissions and LIVE WHERE expressions without additional safeguards.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63749. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart