Medium severity4.3NVD Advisory· Published Jul 20, 2026· Updated Jul 22, 2026
CVE-2026-63733
CVE-2026-63733
Description
SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
surrealdb-corecrates.io | < 3.2.0 | 3.2.0 |
Affected products
2Patches
Vulnerability mechanics
References
7- github.com/advisories/GHSA-66r2-5gwj-gxm2ghsaADVISORY
- github.com/surrealdb/surrealdb/security/advisories/GHSA-66r2-5gwj-gxm2nvdVendor AdvisoryMitigationWEB
- nvd.nist.gov/vuln/detail/CVE-2026-63733ghsaADVISORY
- www.vulncheck.com/advisories/surrealdb-before-permissions-bypass-via-permissions-clausenvdThird Party AdvisoryWEB
- github.com/surrealdb/surrealdb/commit/1e4c3d743e1591f14f340cb627e56d98b6bd7fd7ghsaWEB
- github.com/surrealdb/surrealdb/commit/afea699dfb3c8f274ab36861f8a95f5e98d82f1bghsaWEB
- github.com/surrealdb/surrealdb/releases/tag/v3.2.0ghsaWEB
News mentions
0No linked articles in our index yet.