Executive brief
SurrealDB is a multi-model database used to store and query application data. A flaw in its JSON Patch update operations allows authenticated database users to bypass field-level access controls and read sensitive data they should not have permission to access. An attacker could exploit this to extract confidential information from database records by using a crafted PATCH operation that duplicates protected fields into readable locations.
Technical details
The vulnerability is an incorrect authorization flaw (CWE-863) in SurrealDB's JSON Patch implementation. When an UPDATE … PATCH statement includes a `copy` or `move` operation with an empty `from` pointer, the parser incorrectly treats it as copying the entire record instead of rejecting it as invalid. This causes all fields—including those restricted by field-level SELECT permissions—to be duplicated into attacker-chosen destination fields. The permission filter only hides the original protected field names in responses, not the newly copied destinations, allowing the protected values to leak under new field names. The attack requires authenticated database access and affects only the targeted record per PATCH request. A patch rejecting empty `from` pointers at parse time was introduced in version 3.1.0.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: disclosed: Original advisory GHSA-fpxg-5xmv-922m published
- 2026-05-27: patched: Fixed in version 3.1.0
- 2026-07-20: other: Duplicate advisory GHSA-8pr5-wpg9-2h74 published; CVE-2026-63751 assigned
- 2026-09-04: other: Duplicate advisory withdrawn