CVE-2026-63741

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

6.5 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L                                    

Vulnerability Description

SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated attackers can create arbitrary namespaces and databases by issuing USE commands, bypassing authorization checks in the RPC use method and SurrealQL executor.

Vulnerability Details

Published Date

July 20, 2026

Last Modified

July 20, 2026

CWE ID

CWE-862

Source

NVD

Vendor

surrealdb

Product

surrealdb

External References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-wp87-mgvq-5j93
https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-use-statement

CVE-2026-63741

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment