CVE-2026-63738 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph traversals instead of direct table scans.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability affects SurrealDB versions prior to 3.1.5 and represents a critical authorization bypass flaw that undermines the database's field-level security model. The issue stems from improper permission enforcement during graph traversal operations where attackers can circumvent field-level access controls by leveraging edge-based or back-reference traversals rather than direct table queries. This allows malicious actors with only table-level SELECT permissions to access sensitive data fields that should be restricted at the field level, effectively creating a pathway for unauthorized information disclosure.
The technical flaw manifests in how SurrealDB handles permission checking during traversal operations. When records are accessed through graph edges or back-references, the system fails to validate whether the requesting user has appropriate field-level permissions for the data being materialized. This occurs because the permission enforcement mechanism operates differently during direct table scans versus traversal-based access patterns. The vulnerability specifically impacts scenarios where users can traverse relationships between records using edge connections or back-references that point to related data, allowing them to pull in information from fields they would normally be denied access to.
From an operational impact perspective, this vulnerability enables attackers to perform unauthorized data exfiltration by exploiting the gap in authorization enforcement. An attacker with table-level SELECT privileges can construct graph traversal queries that effectively bypass field-level restrictions, potentially accessing sensitive information such as personal identifiers, financial data, or confidential business information. This represents a significant escalation of privileges since the attacker gains access to data they would normally be restricted from viewing, even though they lack explicit field-level permissions.
The vulnerability aligns with CWE-285, which addresses improper authorization in database systems, and maps to ATT&CK technique T1078.004 for Valid Accounts and T1566.001 for Phishing. Organizations using SurrealDB versions 3.1.0 through 3.1.4 face heightened risk of data breaches where unauthorized access to sensitive information can occur through legitimate database traversal operations. The issue particularly affects systems where graph-based data models are utilized extensively, as these scenarios provide multiple paths for attackers to exploit the permission bypass.
The recommended mitigation strategy involves upgrading to SurrealDB version 3.1.5 or later, which includes fixed permission enforcement logic for traversal operations. Organizations should also implement additional monitoring of graph traversal queries and field-level access patterns to detect anomalous behavior that might indicate exploitation attempts. Database administrators should review and audit existing field-level permissions, ensuring that access controls are properly configured for both direct table access and traversal-based operations. Additionally, implementing comprehensive logging of all database access patterns, including graph traversals, will help in detecting potential exploitation attempts and maintaining audit compliance with security standards such as those outlined in NIST SP 800-53 and ISO/IEC 27001.