PT-2026-61549 · Surrealdb · Surrealdb

Sondt99 · CVE-2026-63733 · Publicado 2026-07-20 · Atualizado 2026-07-20

NVD

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-63733

Produtos afetados

Surrealdb

Referências · 3

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-66r2-5gwj-gxm2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-63733 · Nota de Segurança
• https://vulncheck.com/advisories/surrealdb-before-permissions-bypass-via-permissions-clause · Nota