CVE-2026-63733: SurrealDB permissions bypass via data-modifying statements in PERMISSIONS clause

CVE-2026-63733 · Severity: medium · CVSS 4.3 · Published 2026-07-20

SurrealDB is a database management system that uses PERMISSIONS clauses to enforce fine-grained access controls on table operations. A logic flaw allows users with permission to perform a guarded operation (such as updating a table) to trigger unintended writes to other tables they do not have permission to access by embedding data-modification statements within permission evaluation logic. This bypasses intended access controls and can corrupt or modify data that should be restricted.

Technologies: surrealdb-core (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-63733 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63733 being exploited in the wild.
How severe is CVE-2026-63733?
Medium severity, with a CVSS score of 4.3, published 20 July 2026.
Which products and versions are affected?
surrealdb-core (crates.io) SEMVER:introduced=0,fixed=3.2.0.
Is there a fix for CVE-2026-63733?
Yes. surrealdb-core (crates.io): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63733 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63733?
Check whether you run surrealdb-core (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • surrealdb-core (crates.io): upgrade to 3.2.0 or later
    cargo update -p surrealdb-core

Technical details

This is an authorization bypass (CWE-863) caused by permission evaluation disabling permission enforcement to prevent infinite recursion. However, data-modifying statements (CREATE, UPDATE, DELETE, RELATE, INSERT, UPSERT) embedded within a PERMISSIONS ... WHERE clause execute with enforcement still disabled, allowing a low-privileged user to write to protected tables. The vulnerability affects PERMISSIONS clauses containing writes; FULL, NONE, and read-only clauses are unaffected. The clause evaluates once per matched record, enabling a single statement to cause multiple unintended writes and trigger cascading events or data corruption. The attack requires low-privilege database access but does not allow cross-database/namespace escape or root-level actions. SurrealDB 3.2.0 and later mitigate this by rejecting definitions of writable PERMISSIONS clauses and blocking writes during clause evaluation at runtime.

Affected products

  • SurrealDB SurrealDB < 3.2.0

Identifiers

  • CVE-2026-63733
  • GHSA-66r2-5gwj-gxm2

Timeline

  • 2026-07-02: disclosed
  • 2026-09-04: advisory
  • 2026: patched: SurrealDB 3.2.0 and later

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.