PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-63742 surrealdb CVE debrief

CVE-2026-63742 is a field-level SELECT permission bypass vulnerability in SurrealDB versions before 3.1.0. This issue affects indexed COUNT fast paths, allowing attackers to execute COUNT queries on indexed fields with field-level SELECT restrictions. This can lead to the confirmation or recovery of restricted field values through repeated guesses. The CVSS score for this vulnerability is 5.3, with a severity rating of MEDIUM. Users of SurrealDB versions before 3.1.0 should be aware of this vulnerability and take steps to mitigate it.

Vendor
surrealdb
Product
Unknown
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-22
Advisory published
2026-07-20
Advisory updated
2026-07-22

Who should care

Users of SurrealDB versions before 3.1.0, security teams, and operators should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 3.1.0 or later and implementing additional security measures to protect against potential attacks. Affected operators and platforms should review the vulnerability and take necessary actions to prevent exploitation.

Technical summary

The vulnerability exists in the indexed COUNT fast paths of SurrealDB versions before 3.1.0. Attackers can exploit this by executing COUNT queries on indexed fields that have field-level SELECT restrictions. This allows them to confirm or recover restricted field values through repeated guesses. The vulnerability has a CVSS score of 5.3 and a severity rating of MEDIUM. It is recommended that users of SurrealDB versions before 3.1.0 take steps to mitigate this vulnerability.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it could potentially be used to gain unauthorized access to sensitive data.

Recommended defensive actions

  • Upgrade to SurrealDB version 3.1.0 or later
  • Implement additional security measures to protect against potential attacks
  • Monitor for suspicious activity related to COUNT queries on indexed fields
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-20T12:19:43.573Z and was last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. This vulnerability affects SurrealDB versions before 3.1.0 and is related to a field-level SELECT permission bypass in indexed COUNT fast paths. The CVE record and NVD entry provide limited information, and defenders should verify the affected scope and severity through additional sources.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T12:19:43.573Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.