CVE-2026-63735 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by specifying the target scope in the URL path, reading sensitive data or triggering unintended operations.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists in SurrealDB versions prior to 3.2.0 where the database fails to properly enforce namespace and database scope validation within custom API routes. The flaw stems from inadequate input sanitization and scope verification mechanisms that allow authenticated users to manipulate URL paths to access resources outside their designated tenant boundaries. When users provide valid credentials for any namespace or database, they can exploit this weakness by constructing malicious URLs that specify target scopes in the path, thereby bypassing the intended multi-tenancy isolation.
The technical implementation of this vulnerability involves a missing authorization check within the API routing layer where the system accepts user-provided scope parameters without proper validation against the authenticated session context. This creates a path traversal-like condition where the application processes requests based on URL path components rather than enforcing strict scope boundaries. The flaw directly relates to CWE-285 which addresses improper authorization in software systems, and specifically manifests as an insufficient check or missing check for access control mechanisms.
Operationally, this vulnerability allows attackers to perform unauthorized data access and potential manipulation across different tenant environments within the same SurrealDB instance. An authenticated user could potentially read sensitive information from other namespaces, execute operations in unauthorized scopes, or even trigger unintended system behaviors that could lead to data exposure or service disruption. The impact is particularly severe in multi-tenant deployments where isolation between customers or departments is critical for security compliance and data protection.
The mitigation strategy requires implementing robust scope validation at the API route level where all incoming requests must be verified against the authenticated user's permitted namespaces and databases. This involves enhancing the routing middleware to enforce strict boundary checking before processing custom API endpoints, ensuring that URL path parameters containing scope information are validated against the current session context. Organizations should upgrade to SurrealDB version 3.2.0 or later where these validation mechanisms have been implemented, while also configuring proper access controls and monitoring for unauthorized scope traversal attempts. This vulnerability aligns with ATT&CK technique T1078 which covers valid accounts and privilege escalation through legitimate system access points, making it particularly dangerous in environments where proper principle of least privilege is not enforced.