CVE-2026-63752 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite the target record instead of rejecting the operation.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/20/2026
This vulnerability exists within SurrealDB versions prior to 3.1.0 and represents a critical authorization bypass flaw that undermines the database's access control mechanisms. The issue specifically affects the RELATE statement functionality where authenticated users possessing only CREATE permissions can exploit a design weakness to overwrite existing edge records without requiring the necessary UPDATE permission. This represents a fundamental breakdown in the principle of least privilege enforcement within the database's security model. The vulnerability stems from how SurrealDB processes RELATE statements with SET id clauses, where the system fails to properly validate whether the authenticated user has adequate permissions to modify existing records before proceeding with the overwrite operation.
The technical implementation flaw occurs at the storage layer level where the database engine silently accepts and executes the record overwrite without performing proper permission checks against the target record's access control policies. This behavior violates standard security practices and creates an avenue for privilege escalation attacks. When an attacker issues a RELATE statement containing a SET id clause that references an existing edge identifier, the system bypasses normal update validation procedures and directly modifies the target record. This mechanism operates without proper audit logging or permission verification, making it particularly dangerous as it can go undetected while compromising data integrity.
The operational impact of this vulnerability extends beyond simple unauthorized data modification, as it enables attackers to manipulate relationships within the database's graph structure in ways that could compromise system integrity and data consistency. Graph databases rely heavily on maintaining accurate relationship structures, and this bypass allows malicious actors to alter connection patterns between entities without proper authorization. The silent nature of the overwrite operation means that legitimate administrators may not immediately detect when unauthorized modifications occur, potentially leading to cascading effects throughout dependent systems that rely on the integrity of these relationships. This vulnerability is particularly concerning in environments where database access control is paramount for maintaining data governance policies and regulatory compliance requirements.
Organizations using SurrealDB versions prior to 3.1.0 should immediately implement mitigations including upgrading to the patched version where this authorization bypass has been resolved through enhanced permission validation mechanisms. The fix addresses the core issue by implementing proper access control checks before allowing any record modification operations, ensuring that users with CREATE permissions cannot overwrite existing records without possessing the appropriate UPDATE permissions. Additionally, administrators should review existing access control policies and audit logs to identify any potential unauthorized modifications that may have occurred during the vulnerable period. Security teams should also consider implementing additional monitoring controls specifically designed to detect anomalous RELATE statement patterns that could indicate exploitation attempts, as this vulnerability aligns with attack techniques documented under the attack pattern of privilege escalation through improper access control validation.
This vulnerability corresponds to CWE-285 which addresses improper authorization in software systems, and aligns with ATT&CK technique T1078 for valid accounts and T1496 for resource hijacking. The flaw demonstrates how insufficient input validation and access control checks can create pathways for attackers to bypass security measures, particularly in graph database environments where relationship integrity is crucial for maintaining system security posture. Organizations should treat this as a high-priority remediation item and conduct thorough security assessments of their SurrealDB implementations to ensure comprehensive protection against similar authorization bypass vulnerabilities.