CVE-2026-63735: SurrealDB authorization bypass in custom API routes

CVE-2026-63735 · Severity: high · CVSS 8.1 · Published 2026-07-20

SurrealDB is a multi-tenant database platform that allows administrators to define custom API endpoints with permission rules. An authenticated user with valid credentials to one namespace/database could bypass tenant boundaries by crafting API requests with another tenant's namespace/database in the URL path, allowing them to read data from or modify other tenants' databases. This undermines tenant isolation in shared deployments.

Technologies: surrealdb (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-63735 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63735 being exploited in the wild.
How severe is CVE-2026-63735?
High severity, with a CVSS score of 8.1, published 20 July 2026.
Which products and versions are affected?
surrealdb (crates.io) < 3.2.0, SEMVER:introduced=0,fixed=3.2.0.
Is there a fix for CVE-2026-63735?
Yes. surrealdb (crates.io): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63735 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63735?
Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • surrealdb (crates.io): upgrade to 3.2.0 or later
    cargo update -p surrealdb

Technical details

The vulnerability exists in SurrealDB's custom API route handler (`/api/{namespace}/{database}/{endpoint}`) and the related `api::invoke()` function. The route extracted namespace and database parameters from the URL and applied them to the caller's session before endpoint resolution, without verifying the authenticated principal had authorization to access those scopes. Because custom API handlers run with permissions disabled (definer's rights), only the endpoint's `PERMISSIONS` clause acted as a gate — which could be `PERMISSIONS FULL` (open to all). The same flaw affected dynamic scope selection via `surreal-ns`/`surreal-db` headers or `USE` statements. An attacker with valid credentials for namespace A could invoke endpoints in namespace B by including B in the URL, reading protected data or triggering writes. Patch introduced scope validation against the caller's authenticated level before endpoint resolution, returning `403 Forbidden` for out-of-scope requests. Fixed in version 3.2.0 and later.

Affected products

  • SurrealDB SurrealDB < 3.2.0

Identifiers

  • CVE-2026-63735
  • GHSA-848m-r628-vrxw

Timeline

  • 2026-09-04: disclosed: Published in GitHub Advisory Database
  • 2026-07-02: patched: Fixed in SurrealDB 3.2.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.