CVE-2026-63751
Received Received - Intake

SurrealDB JSON Patch Field-Level Permission Bypass Before 3.1.0

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including those restricted by field-level SELECT permissions, into attacker-chosen destination fields.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63751
EUVD
EUVD-2026-45922

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB versions before 3.1.0 have a field-level permission bypass in JSON Patch operations. Authenticated users can exploit UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including those restricted by field-level SELECT permissions, into attacker-chosen destination fields.

Detection Guidance

Check SurrealDB version with command: surreal version. If version is below 3.1.0, the system is vulnerable. Monitor for unusual JSON Patch operations with empty from pointers in UPDATE PATCH requests.

Impact Analysis

This vulnerability allows attackers to read protected fields they should not have access to by duplicating them into new fields. It exposes sensitive data within a single record per request, potentially leading to unauthorized data access or leaks.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing protected personal or health information. It undermines field-level access controls, increasing the risk of data breaches and regulatory penalties.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.0 or later immediately. Restrict UPDATE PATCH permissions to users with full SELECT permissions. Use SET or MERGE clauses instead of JSON Patch operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63751. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart