DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-63735: CVE-2026-63735: Cross-Tenant Authorization Bypass in SurrealDB Custom API Routing Handler

#security #cve #cybersecurity

CVE-2026-63735: Cross-Tenant Authorization Bypass in SurrealDB Custom API Routing Handler

Vulnerability ID: CVE-2026-63735
CVSS Score: 8.6
Published: 2026-09-04

SurrealDB prior to version 3.2.0 is vulnerable to an authorization bypass where authenticated users can invoke custom API endpoints belonging to other tenants. This cross-tenant data access occurs because the system fails to validate authorization scope boundaries against request-supplied namespace and database identifiers before executing scripts with elevated definer's rights.

TL;DR

An authenticated SurrealDB user with minimal privileges can access and execute custom APIs defined by other tenants in multi-tenant environments, leading to unauthorized read/write access to arbitrary database resources.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-639: Authorization Bypass Through User-Controlled Key
  • Attack Vector: Network
  • CVSS v4.0 Score: 8.6 (High)
  • EPSS Score: 0.00367 (Percentile: 29.78%)
  • Exploit Status: PoC (Proof of Concept documented in integration tests)
  • CISA KEV Status: Not Listed
  • Vulnerability Class: Improper Authorization

Affected Systems

  • SurrealDB instances deployed in multi-tenant environments
  • SurrealDB versions prior to 3.2.0
  • SurrealDB: < 3.2.0 (Fixed in: 3.2.0)

Code Analysis

Commit: 0938f88

Implement authentication scope validation in IAM handler

Commit: 75b7154

Add verification controls to datastore and API routing entrypoints

Exploit Details

Mitigation Strategies

  • Upgrade the database engine to version 3.2.0 or later to ensure proper tenant boundary validation.
  • Manually implement identity verification using $auth context variables within custom API endpoints.
  • Use reverse proxies or API gateways to strip or block unauthorized URL paths targeting sensitive namespaces.

Remediation Steps:

  1. Identify all deployed SurrealDB instances and run surreal version to check if they are below 3.2.0.
  2. Download and install the 3.2.0 or later package from official distribution repositories.
  3. Restart the SurrealDB services with the updated binaries.
  4. Verify the patch by attempting a cross-tenant API invocation using a test account to confirm the server returns a 403 Permission Denied error.

References

Read the full report for CVE-2026-63735 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)