Medium severity4.3NVD Advisory· Published Jul 20, 2026· Updated Jul 22, 2026
CVE-2026-63752
CVE-2026-63752
Description
SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite the target record instead of rejecting the operation.
Affected products
2Patches
Vulnerability mechanics
References
2- github.com/surrealdb/surrealdb/security/advisories/GHSA-f82j-v89j-mf86nvdVendor AdvisoryMitigation
- www.vulncheck.com/advisories/surrealdb-before-relate-statement-record-overwritenvdThird Party Advisory
News mentions
0No linked articles in our index yet.