# CVE-2026-63733: SurrealDB permissions bypass via data-modifying statements in PERMISSIONS clause

Source: https://junglewise.ai/threats/cve-2026-63733-surrealdb-permissions-bypass-via-data-modifying-statements-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-63733 · Severity: medium · CVSS 4.3 · Published 2026-07-20

SurrealDB is a database management system that uses PERMISSIONS clauses to enforce fine-grained access controls on table operations. A logic flaw allows users with permission to perform a guarded operation (such as updating a table) to trigger unintended writes to other tables they do not have permission to access by embedding data-modification statements within permission evaluation logic. This bypasses intended access controls and can corrupt or modify data that should be restricted.

Technologies: [surrealdb-core (crates.io)](https://junglewise.ai/threats/technologies/crates-io-surrealdb-core). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io).

## Quick answers

**Is CVE-2026-63733 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-63733 being exploited in the wild.

**How severe is CVE-2026-63733?** Medium severity, with a CVSS score of 4.3, published 20 July 2026.

**Which products and versions are affected?** surrealdb-core (crates.io) SEMVER:introduced=0,fixed=3.2.0.

**Is there a fix for CVE-2026-63733?** Yes. surrealdb-core (crates.io): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-63733 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-63733?** Check whether you run surrealdb-core (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- surrealdb-core (crates.io): upgrade to 3.2.0 or later

  ```sh
  cargo update -p surrealdb-core
  ```


## Technical details

This is an authorization bypass (CWE-863) caused by permission evaluation disabling permission enforcement to prevent infinite recursion. However, data-modifying statements (CREATE, UPDATE, DELETE, RELATE, INSERT, UPSERT) embedded within a PERMISSIONS ... WHERE clause execute with enforcement still disabled, allowing a low-privileged user to write to protected tables. The vulnerability affects PERMISSIONS clauses containing writes; FULL, NONE, and read-only clauses are unaffected. The clause evaluates once per matched record, enabling a single statement to cause multiple unintended writes and trigger cascading events or data corruption. The attack requires low-privilege database access but does not allow cross-database/namespace escape or root-level actions. SurrealDB 3.2.0 and later mitigate this by rejecting definitions of writable PERMISSIONS clauses and blocking writes during clause evaluation at runtime.

## Affected products

- SurrealDB SurrealDB < 3.2.0

## Identifiers

- CVE-2026-63733
- GHSA-66r2-5gwj-gxm2

## Timeline

- 2026-07-02: disclosed
- 2026-09-04: advisory
- 2026: patched: SurrealDB 3.2.0 and later

## References

- [https://api.github.com/users/sondt99](https://api.github.com/users/sondt99)
- [https://github.com/sondt99](https://github.com/sondt99)
- [https://api.github.com/users/sondt99/gists%7B/gist_id%7D](https://api.github.com/users/sondt99/gists%7B/gist_id%7D)
- [https://api.github.com/users/sondt99/repos](https://api.github.com/users/sondt99/repos)
- [https://avatars.githubusercontent.com/u/87920408?v=4](https://avatars.githubusercontent.com/u/87920408?v=4)
- [https://api.github.com/users/sondt99/events%7B/privacy%7D](https://api.github.com/users/sondt99/events%7B/privacy%7D)

## Related threats

- [RUSTSEC-2026-0454 - Data race and double free via unsound `Send`/`Sync` in `reblessive`](https://junglewise.ai/threats/rustsec-2026-0454-data-race-and-double-free-via-unsound-send-sync-in-b23614bb)
- [SurrealDB improper authorization in field permissions](https://junglewise.ai/threats/cve-2024-58367-surrealdb-improper-authorization-in-field-permissions)
- [SurrealDB improper authentication during database switch](https://junglewise.ai/threats/cve-2024-58363-surrealdb-improper-authentication-during-database-switch)
- [SurrealDB query injection in RPC API signin and signup operations](https://junglewise.ai/threats/cve-2024-58362-surrealdb-query-injection-in-rpc-api-signin-and-signup-operations)
- [SurrealDB denial of service via uncaught exception in parser](https://junglewise.ai/threats/cve-2024-58361-surrealdb-denial-of-service-via-uncaught-exception-in-parser)