PatchSiren cyber security CVE debrief
CVE-2026-63735 surrealdb CVE debrief
CVE-2026-63735 is a high-severity vulnerability in SurrealDB, a database management system. Versions before 3.2.0 fail to validate namespace and database scope in custom API routes. This oversight allows authenticated users to invoke endpoints in different namespaces or databases by specifying the target scope in the URL path. Consequently, attackers with valid credentials for any namespace or database can access custom API endpoints in other tenants, potentially reading sensitive data or triggering unintended operations.
- Vendor
- surrealdb
- Product
- Unknown
- CVSS
- HIGH 8.6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-22
Who should care
System administrators and security professionals responsible for SurrealDB installations, particularly those using versions before 3.2.0, should be aware of this vulnerability. Given the high CVSS score of 8.6, indicating a high severity, immediate attention is advised to assess the risk and apply necessary patches or mitigations.
Technical summary
The vulnerability arises from inadequate validation of namespace and database scope in custom API routes within SurrealDB versions prior to 3.2.0. Authenticated users can exploit this by specifying a different namespace or database in the URL path of custom API endpoints. This could lead to unauthorized access to sensitive data or the execution of unintended operations across different tenants. The CVSS:4.0 vector is AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X, reflecting a high severity score.
Defensive priority
High
Recommended defensive actions
- Inventory and assess SurrealDB installations for version 3.2.0 or later compliance.
- Apply the patch or upgrade to SurrealDB version 3.2.0 or later.
- Implement compensating controls such as monitoring and access restrictions.
- Verify and enforce proper authentication and authorization mechanisms.
- Conduct regular security audits and vulnerability assessments.
Evidence notes
The CVE record was published on 2026-07-20T12:19:42.563Z and was last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. Limited information is available about the specific exploits or attacks related to this vulnerability.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T12:19:42.563Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.