CVE-2026-63745

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

5.4 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N                                    

Vulnerability Description

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-named body fields to spoofed values that permission checks incorrectly read instead of the immutable id key.

Vulnerability Details

Published Date

July 20, 2026

Last Modified

July 20, 2026

CWE ID

CWE-639

Source

NVD

Vendor

surrealdb

Product

surrealdb

External References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6vg3-hgrw-p5gf
https://www.vulncheck.com/advisories/surrealdb-before-authorization-bypass-via-composite-record-id

CVE-2026-63745

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment