EUVD-2026-45911
GHSA-j6mj-v752-pp4x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain record-scope account
-
DeliveryQuery record with permission-filtered array field
-
ExploitTrigger faulty field.* index filtering
-
ExecutionReceive denied array elements
-
ImpactExfiltrate restricted data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated record-scope (record user) account on a SurrealDB instance older than 3.1.4, and the target data must be an array field protected by element-level SELECT permissions expressed with the |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N, base 7.1) is internally consistent with the description: network-reachable, low complexity, requires low privileges (a valid record-scope account), no user interaction, and pure confidentiality impact with no integrity or availability effect. There is no EPSS score, KEV listing, or POC reference in the provided data, so real-world exploitation pressure appears low today and should be treated as opportunistic/targeted rather than mass-exploited. The main risk driver is that the barrier to exploit is low for anyone who already holds a legitimate record account - the bug turns intended data compartmentalization into a leak. VC:H may overstate impact where the protected array elements are low-sensitivity, so severity is data-dependent; verify what the |
| Exploit ScenarioDerived | An attacker registers or obtains a normal record-scope account on an application backed by SurrealDB, then issues a SELECT query against a record containing an array field whose individual elements are protected by |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 20, 2026
Broken authorization in SurrealDB before 3.1.4 allows record-scoped (authenticated) users to read array elements that field-level SELECT permissions are supposed to hide. When permissions are evaluated against array fields using the field.* wildcard, denied elements are leaked back to the caller instead of being filtered out, because the engine mishandles element indexing during permission filtering (CWE-863). No public exploit has been identified at time of analysis and it is not in CISA KEV, but the flaw is a straightforward authorization bypass reachable by any user with record scope access.
RemediationAI
Upgrade to SurrealDB 3.1.4 or later, which contains the corrected array-element permission filtering - Vendor-released patch: 3.1.4. If immediate upgrade is not possible, reduce exposure by avoiding element-level (field.*) SELECT permissions as the sole control for sensitive array data: restructure sensitive elements into separate records or fields protected by whole-field permissions, or move sensitive values out of arrays entirely so record/table-level permissions apply cleanly. Additionally, tighten who can obtain record-scope credentials and audit existing record users, since exploitation requires an authenticated record account. Track the fix and details via the vendor advisory https://github.com/surrealdb/surrealdb/security/advisories/GHSA-8rw6-p7m8-63jp and https://www.vulncheck.com/advisories/surrealdb-before-array-element-permission-bypass. Trade-off: restructuring schema to avoid field.* reliance can require query and application changes, so the upgrade to 3.1.4 remains the clean fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in cargo
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SurrealDB is a multi-model (document/graph/relational) database that enforces row- and field-level access control through record users ("record scope" authentication) and permission clauses defined in the schema. This vulnerability lives in the permission-filtering logic that post-processes SELECT results: for array-valued fields addressed with the field.* wildcard, the engine is meant to strip individual elements the caller is not permitted to see. Due to incorrect index handling while iterating and filtering the array, elements that should be removed remain in the response. This is a classic CWE-863 Incorrect Authorization defect - the permission decision is computed but applied to the wrong positions, so denied data is disclosed rather than withheld.
Know when Surrealdb gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable query interface (AV:N/AC:L), requires a valid record-scope login so PR:L, no user interaction; confidentiality-only disclosure of denied data with no integrity or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrect index handling during permission filtering.
Executive ViewAI
SurrealDB installations using field-level access controls to protect sensitive data are vulnerable (CVE-2026-63740) to unauthorized access by authenticated users who can bypass these permissions to read restricted array elements. This presents a direct data confidentiality breach risk for any organization relying on these controls to protect customer, financial, or other sensitive information. Immediate assessment of affected systems and deployment of interim controls is required to prevent data exposure.
Restrict record-scoped user account access to minimum required records; implement application-layer authorization checks for array field access independent of database-level permissions; avoid field-level wildcard (field.*) permissions on sensitive arrays; enable comprehensive query auditing and alerting on unauthorized permission bypass attempts; segment database access by sensitivity level until patched.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
SurrealDB versions before 3.3.0 fail to validate a caller's authorization level when the SurrealQL USE statement switche
Cross-tenant data access in SurrealDB before 3.3.0 allows an authenticated namespace- or database-level SYSTEM user to b
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB versions before 3.3.0 lets a query-capable authenticated user with embedded JavaScript sc
Exploit-DB