PatchSiren cyber security CVE debrief
CVE-2026-63746 surrealdb CVE debrief
CVE-2026-63746 is a high-severity vulnerability in SurrealDB versions before 3.1.0. The issue allows authenticated users to read records from any table reachable through graph edges, regardless of the target table's SELECT permissions. This occurs due to a failure in enforcing table SELECT permissions when traversing graph edges or back-references. The vulnerability has significant implications for data access control and requires immediate attention from users of affected versions.
- Vendor
- surrealdb
- Product
- Unknown
- CVSS
- HIGH 7.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-22
Who should care
Users of SurrealDB versions before 3.1.0 should prioritize upgrading to version 3.1.0 or later. System administrators and developers using SurrealDB should assess their current version and apply necessary patches to prevent potential unauthorized data access. Additionally, security teams and vulnerability management teams should review the vulnerability details and plan accordingly.
Technical summary
The vulnerability arises from SurrealDB's inability to enforce table SELECT permissions during graph edge traversal or back-references. This allows authenticated users to read records from any reachable table, bypassing intended access controls. The issue is addressed in SurrealDB version 3.1.0. Additional technical details and defensive measures should be considered to fully understand and mitigate this vulnerability.
Defensive priority
High priority should be given to upgrading SurrealDB to version 3.1.0 or later. In the interim, restricting access to sensitive tables and monitoring for unusual query patterns may help mitigate the risk. Additional defensive measures, such as reviewing compensating controls and tracking exceptions, should also be considered.
Recommended defensive actions
- Upgrade SurrealDB to version 3.1.0 or later
- Review and adjust table SELECT permissions
- Monitor for unusual query patterns
- Restrict access to sensitive tables
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
Evidence notes
The CVE record was published on 2026-07-20T12:19:44.143Z and was last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. This information is based on the provided source corpus. Further verification is recommended to confirm the accuracy of this information.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T12:19:44.143Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.