CVE-2026-63752 surrealdb CVE debrief

Who should care

Users of SurrealDB versions prior to 3.1.0 should be aware of this vulnerability and take steps to mitigate it. This includes upgrading to version 3.1.0 or later, and monitoring for suspicious activity related to RELATE statements. Additionally, administrators and security teams responsible for SurrealDB deployments should review the official advisory and take necessary actions to protect their systems.

Technical summary

The vulnerability is caused by a lack of proper authorization checks in the RELATE statement of SurrealDB, allowing authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. This can be exploited by issuing a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite the target record instead of rejecting the operation. Affected product deployments should review official advisories and take steps to mitigate the vulnerability. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM.

Defensive priority

Medium-High due to potential for data tampering and exploitation by authenticated users with CREATE permission.

Recommended defensive actions

• Upgrade to SurrealDB version 3.1.0 or later
• Monitor for suspicious RELATE statements
• Restrict CREATE and UPDATE permissions to authorized users
• Implement additional logging and monitoring for edge record modifications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-20T12:19:45.007Z and last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. References include GitHub advisory GHSA-f82j-v89j-mf86 and Vulncheck advisory. The vulnerability was reported by a researcher and verified by the vendor. The CVE record was assigned by the CVE Numbering Authority.

Official resources