CVE-2026-63733

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.2.0

Description A permissions bypass exists where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers who have permission to perform a guarded operation can write to tables for which they lack authorization by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, leading to unintended writes and data corruption.

Recommendations Update to version 3.2.0 or later.