CVE-2026-63742 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries on indexed fields with field-level SELECT restrictions to confirm or recover restricted field values through repeated guesses.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within SurrealDB versions prior to 3.1.0 and represents a significant authorization flaw that undermines the database's access control mechanisms. The issue specifically affects indexed COUNT operations where the database fails to properly enforce field-level SELECT permissions during fast path execution. When users attempt to perform COUNT queries on indexed fields that are restricted by field-level SELECT permissions, the system erroneously allows these operations to proceed without proper authorization checks, creating a bypass condition that can be exploited for information disclosure.
The technical implementation flaw stems from how SurrealDB handles indexed COUNT queries in its query optimization engine. During fast path execution, the database engine shortcuts the normal permission checking process for COUNT operations on indexed fields, assuming that the operation is safe due to the nature of counting rather than retrieving data. This assumption proves incorrect when field-level SELECT restrictions are in place, as the system fails to validate whether the authenticated user has proper permissions to access the specific field being counted. The vulnerability leverages the fact that COUNT operations on indexed fields can be executed efficiently through optimized code paths, but these paths do not properly integrate with the field-level permission enforcement mechanisms.
The operational impact of this vulnerability is substantial as it allows attackers to perform information recovery attacks through repeated COUNT queries and statistical analysis. By executing multiple COUNT operations against different values or ranges within restricted indexed fields, adversaries can infer the actual values stored in those fields through pattern recognition and mathematical analysis. This constitutes a form of side-channel attack where the permission bypass enables data reconstruction rather than direct data retrieval. The vulnerability is particularly dangerous because it operates silently without generating obvious audit trails, making detection more challenging for security monitoring systems.
The flaw aligns with CWE-284 which addresses improper access control and represents a specific instance of weak authorization in database query execution. This vulnerability also maps to ATT&CK technique T1213.002 related to data from information repositories, as it enables unauthorized access to restricted data through indirect means. Organizations using SurrealDB versions before 3.1.0 should immediately implement the available patch that addresses the field-level permission checking during indexed COUNT operations. Additionally, system administrators should review existing field-level SELECT permissions and consider implementing additional monitoring for unusual COUNT query patterns that might indicate exploitation attempts.
Mitigation strategies include upgrading to SurrealDB version 3.1.0 or later where the vulnerability has been addressed through proper integration of field-level permission checks in fast path execution. Database administrators should also implement comprehensive logging of COUNT operations on indexed fields, particularly when these queries are executed by users with limited access privileges. Network-level monitoring can help detect patterns of repeated COUNT queries that may indicate exploitation attempts, while application-level controls should enforce stricter access validation for database operations. The fix implemented in version 3.1.0 ensures that all COUNT operations on indexed fields properly validate field-level SELECT permissions regardless of the execution path taken by the query optimizer.
This vulnerability demonstrates the critical importance of comprehensive security testing during query optimization processes and highlights how performance optimizations can inadvertently create security weaknesses. The issue emphasizes the need for thorough permission validation even in optimized code paths and serves as a reminder that database systems must maintain consistent security controls across all execution methods, including fast paths designed for performance enhancement. Organizations should conduct regular security assessments of their database systems to identify similar authorization bypass vulnerabilities that may exist in other query optimization features or access control mechanisms.