PT-2026-61568 · Surrealdb · Surrealdb

CVE-2026-63752 · Publicado 2026-07-20 · Atualizado 2026-07-20

NVD

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite the target record instead of rejecting the operation.

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2026-63752

Produtos afetados

Surrealdb

Referências · 3

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-f82j-v89j-mf86 · Aviso do Fabricante
• https://vulncheck.com/advisories/surrealdb-before-relate-statement-record-overwrite · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63752 · Nota de Segurança