Which versions of SurrealDB are affected by CVE-2026-63746?

SurrealDB versions before 3.1.0 contain a permission bypass vulnerability allowing authenticated users to circumvent access controls and read restricted database records through relationship…. A patch is available.

How to fix or mitigate CVE-2026-63746?

Within 24 hours, perform a complete inventory of SurrealDB deployments to identify all instances running versions before 3.1.0, then audit configuration to document which tables are protected with restrictive SELECT permissions and which user roles have legitimate read access to other tables. Within 7 days, implement database access monitoring to detect and alert on unusual access patterns to permission-restricted tables, and apply the principle of least privilege across all database users to limit access to only the tables necessary for their business function. Within 30 days, subscribe to SurrealDB vendor advisories for version 3.1.0 release, test the patched version in a non-production environment to verify permission enforcement, and establish a timeline for upgrading all affected instances with appropriate change management.

SurrealDB CVE-2026-63746

Q: What is the CVSS score of CVE-2026-63746?

CVE-2026-63746 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

EUVD-2026-45917 HIGH

Information Exposure (CWE-200)

2026-07-20 disclosure@vulncheck.com

GHSA-4q5r-gwcx-24m9

Information Disclosure

7.1

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vulncheck) · only source for this CVE.

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 20, 2026 - 15:33 EUVD

Source Code Evidence Fetched

Jul 20, 2026 - 12:34 vuln.today

Analysis Generated

Jul 20, 2026 - 12:34 vuln.today

CVE Published

Jul 20, 2026 - 12:19 cve.org

HIGH 7.1

DescriptionCVE.org

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause.

AnalysisAI

Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT permissions by traversing graph edges or REFERENCES TO back-references, reading full documents from tables defined with PERMISSIONS FOR select NONE. The root cause is that GraphEdgeScan and ReferenceScan fetched records directly from storage without evaluating the target table's permission expression. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, perform a complete inventory of SurrealDB deployments to identify all instances running versions before 3.1.0, then audit configuration to document which tables are protected with restrictive SELECT permissions and which user roles have legitimate read access to other tables. …

Threat intelligence, references, and detailed analysis are available after sign-in.