PT-2026-61549 · Surrealdb · Surrealdb

Sondt99 · CVE-2026-63733 · Published 2026-07-20 · Updated 2026-07-20

NVD

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-63733

Affected Products

Surrealdb

References · 3

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-66r2-5gwj-gxm2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-63733 · Security Note
• https://vulncheck.com/advisories/surrealdb-before-permissions-bypass-via-permissions-clause · Note