Medium severity6.5NVD Advisory· Published Jul 20, 2026· Updated Jul 22, 2026

CVE-2026-63746

Description

SurrealDB versions before 3.1.0 fail to enforce table SELECT permissions when traversing graph edges or back-references. Authenticated users can read records from any table reachable through graph edges regardless of the target table's PERMISSIONS FOR select clause.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
surrealdbcrates.io	< 3.1.0	3.1.0

Affected products

Surrealdb/Surrealdb2 versions
cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*range: <3.1.0
- (no CPE)range: <3.1.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-vjjx-rfw4-rmfcghsaADVISORY
github.com/surrealdb/surrealdb/security/advisories/GHSA-vjjx-rfw4-rmfcnvdVendor AdvisoryMitigationWEB
nvd.nist.gov/vuln/detail/CVE-2026-63746ghsaADVISORY
www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-graph-traversalnvdThird Party AdvisoryWEB

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000