CVE-2026-63763 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database editor role) can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the invoking/querying user rather than their creator, an attacker can plant malicious logic that executes with a higher-privileged user's permissions when that user reads or writes the affected record. This can lead to full privilege escalation, including creation of a root owner and server takeover.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability in SurrealDB prior to versions 2.5.0 and 3.0.0-beta.3 represents a critical confused deputy problem that fundamentally undermines the database's access control mechanisms. This issue stems from the improper handling of executable code within field definitions, where unprivileged users with database editor roles can inject malicious future expressions, functions, or closures into database records. The core technical flaw lies in the execution context mismatch between the user who creates these field definitions and the user who subsequently executes them during query operations.
The operational impact of this vulnerability extends far beyond simple privilege escalation, as it enables attackers to construct persistent backdoors within the database itself. When higher-privileged users perform read or write operations on records containing malicious code, the injected logic executes with the elevated permissions of the accessing user rather than the original creator. This creates a dangerous chain reaction where malicious code can be triggered by legitimate administrative actions, making detection extremely difficult. The vulnerability maps directly to CWE-276, which addresses improper privileges and access control issues, while also aligning with ATT&CK technique T1078.004 for valid accounts and T1548.001 for abuse of privileges.
The exploitation pathway begins with an unprivileged user creating field definitions containing malicious code that leverages the database's query execution engine to execute with elevated privileges. This type of attack is particularly insidious because it doesn't require direct access to privileged accounts, but rather relies on the trust model inherent in the database's query execution system. The vulnerability affects all users who can create or modify fields within the database, including those with editor permissions, making it a widespread concern across various deployment scenarios.
Mitigation strategies must address both the immediate technical flaw and broader architectural concerns. Database administrators should implement immediate patching to versions 2.5.0 or 3.0.0-beta.3 where this vulnerability has been resolved. Additionally, organizations should establish strict field definition policies that prevent unprivileged users from creating executable code within database records. Network segmentation and monitoring of database query patterns can help detect anomalous behavior that might indicate exploitation attempts. The fix likely involves implementing stricter context validation during query execution, ensuring that code execution occurs in the appropriate privilege context rather than allowing arbitrary code injection through field definitions. This vulnerability highlights the critical importance of proper input validation and privilege separation in database systems, particularly when dealing with dynamic code execution capabilities that bypass traditional access control mechanisms.