Medium severity6.5NVD Advisory· Published Jul 20, 2026· Updated Jul 22, 2026
CVE-2026-63740
CVE-2026-63740
Description
SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrect index handling during permission filtering.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
surrealdbcrates.io | < 3.1.4 | 3.1.4 |
Affected products
2Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-8rw6-p7m8-63jpghsaADVISORY
- github.com/surrealdb/surrealdb/security/advisories/GHSA-8rw6-p7m8-63jpnvdVendor AdvisoryMitigationWEB
- nvd.nist.gov/vuln/detail/CVE-2026-63740ghsaADVISORY
- www.vulncheck.com/advisories/surrealdb-before-array-element-permission-bypassnvdThird Party AdvisoryWEB
- github.com/surrealdb/surrealdb/commit/8f89b260bb9692e5b0d58930793d482a8207eedcghsaWEB
News mentions
0No linked articles in our index yet.