Permission check bypass in SurrealDB SELECT and update statements (CVE-2026-63755)

SurrealDB evaluates user-supplied WHERE clauses and SET/MERGE/CONTENT/PATCH clauses against full record data before enforcing table-level PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user, including Record and Scope users, can exploit this ordering flaw to read the full contents of any table within their current database, bypassing configured permission controls. Exfiltration is achievable via scripting functions, SurrealQL THROW statements, or timing-based side channels. Affected versions: - <3.1.0 We recommend updating to: 3.1.0. CVSS 7.1 · our assessment: this_week Reference: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-98fx-66cf-fc7c Details: https://vuln.today/cve/CVE-2026-63755