DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-63733: CVE-2026-63733: Incorrect Authorization in SurrealDB Permissions Clause

#security #cve #cybersecurity

CVE-2026-63733: Incorrect Authorization in SurrealDB Permissions Clause

Vulnerability ID: CVE-2026-63733
CVSS Score: 4.3
Published: 2026-09-04

An incorrect authorization vulnerability (CWE-863) in SurrealDB allows authenticated, low-privileged users to execute unauthorized state-modifying queries. This occurs because the database disabled permissions during evaluation of custom PERMISSIONS WHERE predicates to prevent infinite recursion.

TL;DR

A design flaw in SurrealDB allows authenticated users to bypass read-only database permission rules, enabling unauthorized writes and data modification through nested permission queries.

Technical Details

  • CWE ID: CWE-863
  • Attack Vector: Network
  • CVSS v3.1 Score: 4.3
  • EPSS Score: 0.00287
  • Impact: Incorrect Authorization (Integrity Bypass)
  • Exploit Status: None (No public exploit available)
  • KEV Status: Not Listed

Affected Systems

  • SurrealDB
  • SurrealDB: < 3.2.0 (Fixed in: 3.2.0)

Code Analysis

Commit: 1e4c3d7

Fix: Prevent side-effects in PERMISSIONS clauses (core fix)

Commit: afea699

Cherry-pick permissions side-effect prevention fix into release branch

Mitigation Strategies

  • Upgrade database instances to SurrealDB 3.2.0 or newer.
  • Review existing user-defined functions and database schemas for state-modifying actions inside PERMISSIONS WHERE clauses.
  • Limit user access to critical schema configuration controls and restrict access roles to the absolute minimum necessary.

Remediation Steps:

  1. Connect to the target SurrealDB database using administrative credentials.
  2. Execute INFO FOR DB; to export and extract all active schema configurations.
  3. Examine all DEFINE TABLE, DEFINE FIELD, and DEFINE FUNCTION directives for PERMISSIONS ... WHERE statements.
  4. Rewrite custom filters to use static, variable-based criteria (e.g. $auth.id comparison) instead of querying or calling stateful functions.
  5. Deploy SurrealDB version 3.2.0 via your standard container or package management pipeline.

References

Read the full report for CVE-2026-63733 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)