CVE-2026-63752

SurrealDB prior to 3.1.0 contains an authorization bypass in the RELATE statement. Authenticated users with CREATE permission can cause the storage layer to silently overwrite an existing edge record by issuing a RELATE with a SET id clause targeting that edge, bypassing UPDATE checks. The issue ...

EUVD-2026-45923

SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing ed...

CVE-2026-63752 SurrealDB before 3.1.0 RELATE Statement Record Overwrite

SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing ed...

PT-2026-61568

SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing ed...