CVE-2026-63745 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-named body fields to spoofed values that permission checks incorrectly read instead of the immutable id key.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists in SurrealDB versions prior to 3.1.0 and represents a critical authorization bypass flaw that undermines the database's security model. The issue stems from how the system handles composite record identifiers where authenticated users can manipulate the underlying data structure through writable body fields. When a user attempts to access or modify records, the permission checking mechanism incorrectly evaluates spoofed values from body fields instead of relying on the immutable record identifier components that should govern access control decisions. This fundamental flaw allows attackers to bypass tenant isolation mechanisms and other permission-based restrictions that depend on specific id component values.
The technical implementation of this vulnerability leverages the database's field handling logic where composite identifiers consist of multiple components that should remain immutable during operations. When users write to editable body fields that share names with the identifier components, the system's permission evaluation process fails to properly distinguish between actual record identifiers and user-modifiable body data. This creates a scenario where attackers can craft requests that appear to reference one tenant or access level while actually operating under different permissions through the spoofed values. The flaw operates at the intersection of data integrity and access control mechanisms, where the system's trust model is compromised by treating user-provided body field values as authoritative for permission decisions.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass complete breakdown of tenant isolation and data protection boundaries within SurrealDB deployments. Organizations relying on SurrealDB for multi-tenant applications face significant risk of cross-tenant data exposure, where users can potentially access or modify records belonging to other tenants by simply manipulating body fields that correspond to the identifier components. This vulnerability essentially renders the database's built-in access control mechanisms ineffective for any permission rules that depend on composite record identifiers, creating a pathway for privilege escalation and unauthorized data manipulation that could affect entire database schemas and user bases.
Security mitigations for this vulnerability require immediate patching to SurrealDB version 3.1.0 or later where the authorization bypass has been addressed through enhanced field validation and proper separation of immutable identifier components from mutable body fields. Organizations should implement comprehensive access control reviews to identify any applications that might be affected by this issue and consider deploying additional monitoring for suspicious access patterns that could indicate exploitation attempts. The fix addresses the underlying CWE-284 permission flaw by ensuring that immutable record identifiers are properly isolated from user-modifiable fields during permission evaluation processes, preventing attackers from crafting requests that could bypass security controls through field manipulation techniques. This vulnerability also highlights the importance of following ATT&CK framework principles for privilege escalation and defense evasion where attackers can exploit implementation flaws in access control systems to gain unauthorized privileges.