CVE-2026-63733 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists in SurrealDB versions prior to 3.2.0 and represents a critical permissions bypass flaw that undermines the database's access control mechanisms. The issue stems from how the system processes data-modifying statements within PERMISSIONS clauses, where these operations execute with enforcement disabled regardless of the user's actual privileges. This design flaw creates a pathway for attackers who possess permission to perform certain guarded operations to escalate their privileges and gain unauthorized write access to tables they should not be able to modify.
The technical implementation of this vulnerability allows malicious actors to embed destructive data-modifying statements directly within PERMISSIONS clauses, effectively bypassing the normal access control checks that should prevent unauthorized database modifications. When an attacker with limited permissions attempts a guarded operation, they can manipulate the PERMISSIONS clause to include CREATE, UPDATE, DELETE, or UPSERT statements that execute with elevated privileges, causing unintended writes and potential data corruption throughout the system. This represents a fundamental breakdown in the principle of least privilege enforcement within the database's security architecture.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass significant data integrity risks and potential system compromise. Attackers can leverage this flaw to perform unauthorized modifications to critical tables, potentially leading to data loss, information disclosure, or complete system corruption depending on the sensitivity of the affected data stores. The vulnerability's severity is amplified by its ability to bypass multiple layers of security controls that should normally prevent such unauthorized operations from occurring.
Organizations using affected SurrealDB versions should immediately implement mitigations including upgrading to version 3.2.0 or later where this vulnerability has been addressed through proper enforcement of access controls within PERMISSIONS clauses. Additional defensive measures include implementing strict monitoring of database permissions and access patterns, conducting comprehensive security audits of existing permission configurations, and ensuring that only privileged users have the ability to modify PERMISSIONS clauses. This vulnerability aligns with CWE-284 (Improper Access Control) and could be categorized under ATT&CK technique T1078 (Valid Accounts) when exploited by attackers who leverage legitimate permissions to escalate privileges through this bypass mechanism.