CVE-2026-63751 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including those restricted by field-level SELECT permissions, into attacker-chosen destination fields.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within SurrealDB versions prior to 3.1.0 and represents a critical field-level permission bypass that undermines the database's access control mechanisms. The flaw specifically affects JSON Patch operations during UPDATE operations where authenticated users can exploit a weakness in how the system handles copy and move operations with empty from pointers. When an attacker constructs a PATCH request using the json-patch format with copy or move operations that reference an empty from pointer, the system fails to properly validate field-level permissions for the destination fields being written to.
The technical implementation of this vulnerability stems from insufficient validation during JSON Patch processing where the system does not adequately check whether the user has appropriate SELECT permissions on the source fields when performing copy or move operations. This allows attackers to effectively bypass field-level access controls by leveraging the special case handling of empty from pointers in the json-patch specification, enabling them to duplicate restricted data into accessible destination fields without proper authorization. The vulnerability specifically impacts the database's ability to enforce field-level SELECT permissions as defined in the field-level security model that should prevent unauthorized reading of sensitive data.
The operational impact of this vulnerability is severe as it allows authenticated attackers with minimal privileges to extract protected information from records they should not be able to access directly. This creates a significant data exposure risk where sensitive fields containing personal information, credentials, or other confidential data can be copied into accessible locations through legitimate database update operations. The attack vector requires only that the attacker have authentication credentials and knowledge of the target record structure, making it particularly dangerous in environments where database access is granted to multiple users with varying permission levels. This vulnerability essentially undermines the fundamental security principle of least privilege by allowing unauthorized data reading through legitimate database modification operations.
Mitigation strategies should focus on upgrading to SurrealDB version 3.1.0 or later where this vulnerability has been addressed through proper validation of field-level permissions during JSON Patch operations. Administrators should also implement additional monitoring and logging of PATCH operations, particularly those involving copy and move operations with empty from pointers, to detect anomalous behavior. The fix implemented in version 3.1.0 likely involves strengthening the permission checking logic to ensure that both source and destination fields are properly validated against user access rights before allowing copy or move operations to proceed. Organizations should also consider implementing database activity monitoring solutions that can detect unusual patterns of field duplication within their SurrealDB instances.
This vulnerability aligns with CWE-639 which describes "Authorization Bypass Through User-Controlled Key" and represents a specific case where the user-controlled key is the json-patch operation itself. From an ATT&CK perspective, this maps to T1566.002 - "Phishing: Spearphishing Attachment" in cases where attackers might leverage this vulnerability after initial compromise, but more importantly relates to T1078 - "Valid Accounts" since it requires authentication to exploit. The vulnerability demonstrates how seemingly legitimate database operations can be weaponized to bypass security controls, highlighting the importance of comprehensive input validation and access control enforcement across all database operations rather than relying solely on high-level permission models that may have implementation gaps.