CVE-2026-63740 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrect index handling during permission filtering.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability affects SurrealDB versions prior to 3.1.4 and represents a critical authorization flaw that undermines the database's permission model. The issue manifests when users with record-level scope access attempt to query array elements using field.* syntax, where the system fails to properly enforce SELECT permissions on individual array elements. This misconfiguration allows unauthorized data leakage through incorrect index handling during permission filtering operations.
The technical root cause stems from improper handling of array element indexing within the permission enforcement mechanism. When a user with record scope accesses an array field using field.* notation, the database should filter out array elements that the user lacks explicit SELECT permissions for. However, due to flawed index processing logic, the system incorrectly processes these permissions, resulting in unauthorized access to array elements that should remain hidden based on element-level security policies. This vulnerability directly relates to CWE-284 Access Control Bypass and aligns with ATT&CK technique T1078 Valid Accounts and T1566 Phishing.
The operational impact of this vulnerability is significant as it enables attackers to bypass intended access controls and extract sensitive information from array fields. An attacker with record-level scope access can exploit this flaw to gain visibility into array elements that should be restricted, potentially exposing confidential data or system internals. This issue particularly affects environments where users have limited access but need to interact with complex data structures containing sensitive information within arrays.
Organizations using affected SurrealDB versions should immediately implement mitigations including upgrading to version 3.1.4 or later where this permission enforcement has been corrected. Additionally, administrators should conduct thorough audits of existing permission configurations and review all array field access patterns to identify potential exploitation vectors. Network segmentation and monitoring of database access patterns can help detect anomalous queries that might indicate attempted exploitation of this vulnerability. The fix addresses the core indexing logic issue in the permission filtering system, ensuring proper enforcement of SELECT permissions on individual array elements regardless of user scope level.