CVE-2026-63745

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0

Description Authenticated users can bypass authorization by spoofing composite record-id field values. This occurs when attackers write to editable body fields using names that match id components, such as those used for tenant isolation. Permission checks incorrectly read these spoofed body fields instead of the immutable id key, allowing unauthorized access.

Recommendations Update SurrealDB to version 3.1.0 or later.