Confused deputy privilege escalation in SurrealDB via future fields and functions (CVE-2026-63763)

Unprivileged users with roles such as database editor can create or modify record fields containing futures, functions, or closures. Because these constructs execute in the context of the querying or invoking user rather than their creator, an attacker can plant malicious logic that runs with the elevated permissions of any higher-privileged user who subsequently reads or writes the affected record. Successful exploitation can result in full privilege escalation, including creation of a root owner account and complete server takeover. Affected versions: - <2.5.0 - <3.0.0-beta.3 We recommend updating to: 2.5.0, 3.0.0-beta.3. CVSS 7.5 · our assessment: this_week Reference: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3v2x-9xcv-2v2v Details: https://vuln.today/cve/CVE-2026-63763