Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 4.3, published 20 July 2026.

Is there a fix for This vulnerability?

A patch was published on 2026-05-27: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

SurrealDB field-level permission bypass in JSON Patch

Severity: medium · CVSS 4.3 · Published 2026-07-20

SurrealDB is a multi-model database used to store and query application data. A flaw in its JSON Patch update operations allows authenticated database users to bypass field-level access controls and read sensitive data they should not have permission to access. An attacker could exploit this to extract confidential information from database records by using a crafted PATCH operation that duplicates protected fields into readable locations.

Technologies: surrealdb (crates.io). Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 4.3, published 20 July 2026.
Which products and versions are affected?: surrealdb (crates.io) < 3.1.0.
Is there a fix for This vulnerability?: A patch was published on 2026-05-27: Fixed in version 3.1.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an incorrect authorization flaw (CWE-863) in SurrealDB's JSON Patch implementation. When an UPDATE … PATCH statement includes a `copy` or `move` operation with an empty `from` pointer, the parser incorrectly treats it as copying the entire record instead of rejecting it as invalid. This causes all fields—including those restricted by field-level SELECT permissions—to be duplicated into attacker-chosen destination fields. The permission filter only hides the original protected field names in responses, not the newly copied destinations, allowing the protected values to leak under new field names. The attack requires authenticated database access and affects only the targeted record per PATCH request. A patch rejecting empty `from` pointers at parse time was introduced in version 3.1.0.

Affected products

SurrealDB SurrealDB < 3.1.0

Timeline

2026-05-27: disclosed: Original advisory GHSA-fpxg-5xmv-922m published
2026-05-27: patched: Fixed in version 3.1.0
2026-07-20: other: Duplicate advisory GHSA-8pr5-wpg9-2h74 published; CVE-2026-63751 assigned
2026-09-04: other: Duplicate advisory withdrawn

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.