CVE-2026-63751 surrealdb CVE debrief

Who should care

Users of SurrealDB versions before 3.1.0 should be aware of this vulnerability and take necessary actions to protect their systems. This includes upgrading to version 3.1.0 or later and reviewing access controls and permissions. System administrators and security teams should review and update access controls, and developers should ensure that the fix is applied in a timely manner.

Technical summary

The vulnerability exists in the JSON Patch operations of SurrealDB, allowing authenticated users to bypass field-level permissions. By using UPDATE PATCH with an empty 'from' pointer, attackers can duplicate restricted fields into accessible fields. This vulnerability has a CVSS score of 5.3 and is classified as MEDIUM severity. The affected product is SurrealDB versions before 3.1.0. SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including those restricted by field-level SELECT permissions, into attacker-chosen destination fields. Users of SurrealDB should review access controls and ensure the fix is applied.

Defensive priority

Medium priority should be given to addressing this vulnerability, as it allows for the potential exposure of sensitive data. System administrators should review and update access controls, and developers should ensure that the fix is applied in a timely manner.

Recommended defensive actions

• Upgrade SurrealDB to version 3.1.0 or later
• Review and update access controls and permissions
• Monitor system logs for suspicious activity
• Implement additional security measures to protect sensitive data
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-20T12:19:44.873Z and last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. This information is based on the provided source corpus. Further verification is recommended to confirm the accuracy of this information.

Official resources