Is CVE-2026-63755 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63755 being exploited in the wild.

How severe is CVE-2026-63755?

Medium severity, with a CVSS score of 6.5, published 20 July 2026.

Which products and versions are affected?

surrealdb (crates.io) SEMVER:introduced=0,fixed=3.1.0.

Is there a fix for CVE-2026-63755?

Yes. surrealdb (crates.io): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63755 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-63755?

Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63755: SurrealDB authorization bypass in WHERE clause evaluation

CVE-2026-63755 · Severity: medium · CVSS 6.5 · Published 2026-07-20

SurrealDB is a multi-model database used for managing structured and unstructured data. A security flaw in how the database processes queries allows an authenticated user to bypass table-level security restrictions and view sensitive data they are not authorized to see. This could lead to the unauthorized exposure of an entire database's contents to any user with basic access.

Technologies: surrealdb (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-63755 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63755 being exploited in the wild.
How severe is CVE-2026-63755?: Medium severity, with a CVSS score of 6.5, published 20 July 2026.
Which products and versions are affected?: surrealdb (crates.io) SEMVER:introduced=0,fixed=3.1.0.
Is there a fix for CVE-2026-63755?: Yes. surrealdb (crates.io): upgrade to 3.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63755 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-63755?: Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

surrealdb (crates.io): upgrade to 3.1.0 or later
```
cargo update -p surrealdb
```

Technical details

An incorrect authorization flaw (CWE-863) exists in SurrealDB due to the order of operations during query execution. The database evaluates user-supplied clauses (WHERE, SET, MERGE, CONTENT, PATCH) against full record data before enforcing 'PERMISSIONS FOR SELECT WHERE' restrictions. An authenticated attacker, including Record and Scope users, can exploit this by using side-effecting expressions—such as scripting functions, the THROW statement, or timing-based side channels—to exfiltrate record contents. The vulnerability is limited to the database the user is authenticated to and does not cross namespace boundaries. The issue is fixed in version 3.1.0 by ensuring permission checks occur before expression evaluation.

Affected products

SurrealDB SurrealDB < 3.1.0

Identifiers

CVE-2026-63755
GHSA-98fx-66cf-fc7c

Timeline

2026-05-27: advisory: GitHub Security Advisory published
2026-07-20: disclosed: NVD publication date
2026-07-20: patched: Version 3.1.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.