PatchSiren cyber security CVE debrief
CVE-2026-63755 surrealdb CVE debrief
CVE-2026-63755 is a high-severity vulnerability in SurrealDB, a database management system. The vulnerability allows an authenticated user, including Record and Scope users, to bypass table-level permission checks and read the full contents of any table in the database they are authenticated against. This is achieved by exploiting the ordering flaw in the evaluation of user-supplied WHERE clauses in SELECT statements and other update-variant statements. The vulnerability is confined to the attacker's current database and does not cross namespace or database isolation boundaries.
- Vendor
- surrealdb
- Product
- Unknown
- CVSS
- HIGH 7.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-22
Who should care
Users of SurrealDB, especially those with authenticated users, should be aware of this vulnerability and take immediate action to mitigate it. This includes upgrading to SurrealDB version 3.1.0 or later, and ensuring that all users have the necessary permissions to access sensitive data.
Technical summary
The vulnerability exists in SurrealDB versions before 3.1.0. The issue arises from the evaluation of user-supplied WHERE clauses in SELECT statements and other update-variant statements against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. This allows an authenticated user to read the full contents of any table in the database they are authenticated against, bypassing table-level permission checks. The vulnerability can be exploited via SurrealQL's THROW statement and timing-based side channels without scripting, although scripting functions must be enabled for more direct exfiltration.
Defensive priority
High
Recommended defensive actions
- Upgrade to SurrealDB version 3.1.0 or later
- Ensure that all users have the necessary permissions to access sensitive data
- Monitor database activity for suspicious queries
- Implement additional security measures, such as access controls and auditing
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The CVE record was published on 2026-07-20T12:19:45.433Z and was last modified on 2026-07-21T18:37:56.803Z. The NVD entry is currently Awaiting Analysis. The vulnerability has a CVSS score of 7.1 and a severity of HIGH.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T12:19:45.433Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.