CVE-2026-63735

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.2.0

Description Custom API routes fail to validate namespace and database scope, which allows authenticated users to invoke endpoints across different namespaces or databases. An attacker with valid credentials for any namespace or database can access custom API endpoints belonging to other tenants by specifying the target scope within the URL path. This can lead to the unauthorized reading of sensitive data or the triggering of unintended operations.

Recommendations Update SurrealDB to version 3.2.0 or later.