Executive brief
SurrealDB, a multi-model database, contains a flaw where certain data fields can be viewed by unauthorized users. While the system correctly blocks direct access to sensitive fields, users with basic access to a table can bypass these restrictions by using specific database relationship queries (graph traversals). This could allow an attacker to read sensitive information they are supposed to be restricted from seeing, though they cannot modify or delete any data.
Technical details
An authorization bypass exists in SurrealDB's query execution engine. The shared 'resolve_record_batch' helper, used by GraphEdgeScan and ReferenceScan, fails to apply field-level filtering (build_field_state/filter_fields_by_permission) that is normally present in standard table scans. An attacker with table-level SELECT privileges can exploit this by using graph-edge (->) or back-reference (<~) traversals to materialize full records, thereby exposing fields explicitly hidden by 'DEFINE FIELD ... PERMISSIONS FOR select NONE' statements. The vulnerability is limited to confidentiality; it does not bypass row-level WHERE predicates or allow unauthorized cross-table access. The issue is patched in version 3.1.5.
Affected products
- surrealdb surrealdb >= 3.1.0, < 3.1.5
Timeline
- 2026-06-19: advisory: GHSA-hv6h-hc26-q48p published by SurrealDB
- 2026-07-20: disclosed: NVD publication of CVE-2026-63738
- 2026-07-20: patched: Fix released in version 3.1.5