CVE-2026-63748

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw...

CVE-2026-63748 SurrealDB before 3.1.0 Information Disclosure via Error Messages

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw...

CVE-2026-63748

SurrealDB before 3.1.0 contains an information disclosure vulnerability: authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions via error messages. Attackers can trigger arithmetic/extend operations on hidden fields to embed raw operand values in res...

CVE-2026-63748 SurrealDB before 3.1.0 Information Disclosure via Error Messages

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw...

CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use

SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process...

CVE-2026-63747

SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process...

EUVD-2026-45919

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw...

EUVD-2026-45918

SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process...

CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use

SurrealDB versions before 3.1.0 contain a denial of service vulnerability in the RPC use handler that panics when db is set without a namespace. Unauthenticated attackers can send a malformed WebSocket message to the /rpc endpoint to crash the server process...

CVE-2026-63747

SurrealDB prior to 3.1.0 contains a denial-of-service condition in the RPC use handler. When a request sets db without a namespace, a malformed WebSocket message sent to the /rpc endpoint can cause the server process to panic, leading to service disruption. The issue is exploitable by unauthentic...

EUVD-2026-45917

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause...

CVE-2026-63746

SurrealDB is affected in versions before 3.1.0 where SELECT permissions are not enforced during graph traversal and traversal of back-references. The root cause is failure to apply PERMISSIONS FOR select on target tables when navigating graph edges, allowing authenticated users to read records fr...

CVE-2026-63746 SurrealDB before 3.1.0 Permission Bypass via Graph Traversal

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause...

CVE-2026-63746 SurrealDB before 3.1.0 Permission Bypass via Graph Traversal

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause...

CVE-2026-63745 SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...

CVE-2026-63745 SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...

EUVD-2026-45916

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...

CVE-2026-63745

SurrealDB prior to 3.1.0 contains an authorization bypass in which authenticated users can spoof composite record-id field values by writing to editable body fields. This allows bypassing permission checks that gate access on id components (e.g., tenant isolation) by setting same-named body field...

CVE-2026-63745

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-name...

CVE-2026-63743 SurrealDB before 3.1.0 Port-Specific Deny Rule Bypass via HTTP Redirect

SurrealDB before 3.1.0 contains a capability bypass vulnerability in HTTP redirect handling that allows authenticated users to circumvent port-scoped --deny-net rules. Attackers can chain an HTTP redirect from an allowed hostname to a denied host:port combination, and the redirect is followed...