CVE-2026-63752
Received Received - Intake

Authorization Bypass in SurrealDB RELATE Statement

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite the target record instead of rejecting the operation.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63752
EUVD
EUVD-2026-45923

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 3.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB before version 3.1.0 has an authorization bypass flaw in the RELATE statement. Authenticated users with CREATE permission can overwrite existing edge records by specifying an existing edge ID in a SET clause. The system incorrectly allows this overwrite instead of rejecting the operation, even without UPDATE permission.

Detection Guidance

To detect this vulnerability, monitor SurrealDB logs for RELATE statements containing SET id clauses pointing to existing edge IDs. Check for unexpected record overwrites in edge tables. Review user permissions to ensure only trusted users have CREATE permission on edge tables.

Impact Analysis

An attacker with CREATE permission could modify or corrupt data by overwriting existing edge records they should not have access to. This could lead to data integrity issues, such as altering relationships between nodes or corrupting database structure. The impact is limited to data integrity as confidentiality and availability are not affected.

Compliance Impact

This vulnerability could lead to unauthorized data modification, potentially violating integrity requirements in GDPR and HIPAA. GDPR emphasizes data accuracy and security, while HIPAA requires integrity controls for protected health information. Unauthorized changes may result in non-compliance if sensitive data is altered without proper authorization.

Mitigation Strategies

Upgrade SurrealDB to version 3.1.0 or later. Restrict CREATE permissions on edge tables to trusted users only. Implement application-level checks to verify record existence before issuing RELATE statements with explicit IDs. Consider using UPSERT instead of RELATE for create-or-replace operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63752. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart