CVE-2026-63745Medium· 5.4▾ SunlitSurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.2%
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-named body fields to spoofed values that permission checks incorrectly read instead of the immutable id key.
surrealdb < 3.1.0Upgrade past the affected range:
surrealdb 3.1.0Connected by shared product, vendor, weakness, or advisory.
GHSA-6vg3-hgrw-p5gfMedium· 5.4SurrealDB has an Authorization Bypass via Composite Record-id Paths
CVE-2026-102876High· 8.1SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check_auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB head…
CVE-2026-63735High· 8.1SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path
CVE-2026-63752Medium· 4.3SurrealDB before 3.1.0 RELATE Statement Record Overwrite
CVE-2026-63746Medium· 6.5SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references
CVE-2026-63761Medium· 4.3SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ..