CVE-2026-63746 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists in SurrealDB versions prior to 3.1.0 where the database fails to properly enforce table-level SELECT permissions during graph traversal operations. The flaw allows authenticated users to access records from any table that can be reached through graph edges or back-references, completely bypassing the intended permission controls that should restrict access based on the target table's PERMISSIONS FOR select clause. The issue stems from insufficient validation of access controls during edge traversal and back-reference resolution processes.
The technical implementation flaw occurs when SurrealDB processes graph queries that involve traversing relationships between tables or accessing back-references to parent records. During these operations, the system should validate that the authenticated user has appropriate SELECT permissions on each target table encountered in the traversal path. However, the permission checking mechanism fails to properly verify access rights for tables accessed through graph relationships, effectively allowing unauthorized data reading from any reachable table regardless of its specific permission configuration.
This vulnerability creates significant operational impact by undermining the fundamental principle of least privilege within the database system. An authenticated user who might only have read access to a specific table could potentially access data from multiple tables throughout the database schema simply by traversing graph relationships. The security implications extend beyond simple unauthorized data access, as this could enable attackers to discover sensitive information across interconnected datasets that should remain isolated based on their permission settings.
The flaw aligns with CWE-284 Access Control Issues, specifically addressing inadequate permissions enforcement during graph traversal operations and represents a critical weakness in the database's authorization model. From an ATT&CK perspective, this vulnerability maps to privilege escalation techniques where attackers can leverage existing authenticated sessions to access data beyond their assigned permissions, potentially enabling information gathering and lateral movement within the database environment.
Organizations should immediately upgrade to SurrealDB version 3.1.0 or later where this permission enforcement has been properly implemented. Additionally, administrators should review existing graph relationships and back-reference configurations to ensure that appropriate access controls are in place for all tables involved in traversal operations. Regular auditing of database permissions and monitoring for unusual query patterns involving graph traversal should be implemented as part of the security posture assessment. The mitigation strategy should also include implementing additional network-level access controls and database activity monitoring to detect potential exploitation attempts before they can cause significant data exposure.