CVE-2026-63763
Received Received - Intake

Privilege Escalation in SurrealDB via Malicious Futures

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database editor role) can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the invoking/querying user rather than their creator, an attacker can plant malicious logic that executes with a higher-privileged user's permissions when that user reads or writes the affected record. This can lead to full privilege escalation, including creation of a root owner and server takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63763
EUVD
EUVD-2026-45934

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 2.5.0|end_excluding=3.0.0-beta.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63763 is a confused deputy privilege escalation vulnerability in SurrealDB versions before 2.5.0 and 3.0.0-beta.3. Unprivileged users with roles like database editor can create or modify fields containing futures, functions, or closures. These fields execute with the permissions of the querying user rather than the creator, allowing attackers to embed malicious logic that runs with elevated permissions when a higher-privileged user interacts with the record.

Detection Guidance

Check SurrealDB version with: surreal version. If version is below 2.5.0 or 3.0.0-beta.3, the system is vulnerable. Inspect database records for fields containing futures, functions, or closures using queries like SELECT * FROM table WHERE type = 'function' OR type = 'future' OR type = 'closure'.

Impact Analysis

This vulnerability can lead to full privilege escalation, including the creation of a root owner and server takeover. Attackers could exploit it to gain elevated access, execute arbitrary code, or cause denial of service. Even read operations might result in limited denial of service or, in specific cases, information exfiltration over the network.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR (e.g., unauthorized data processing or disclosure) and HIPAA (e.g., unauthorized access to protected health information). The potential for privilege escalation and server takeover exacerbates these risks by allowing attackers to bypass access controls entirely.

Mitigation Strategies

Upgrade SurrealDB to version 2.5.0 or 3.0.0-beta.3 or later immediately. If upgrading is not possible, restrict low-privileged users from creating or modifying fields containing functions, futures, or closures. Review and remove any existing malicious records or fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63763. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart