Unrated severityNVD Advisory· Published Jul 20, 2026· Updated Jul 28, 2026
SurrealDB before 3.1.0 RELATE Statement Record Overwrite
CVE-2026-63752
Description
SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite the target record instead of rejecting the operation.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/surrealdb/surrealdb/security/advisories/GHSA-f82j-v89j-mf86mitrevendor-advisory
- www.vulncheck.com/advisories/surrealdb-before-relate-statement-record-overwritemitrethird-party-advisory
News mentions
0No linked articles in our index yet.