CVE-2026-63755

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0

Description An ordering flaw exists where user-supplied WHERE clauses in SELECT statements, as well as SET, MERGE, CONTENT, and PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements, are evaluated against full record data before PERMISSIONS FOR SELECT WHERE restrictions are enforced. An authenticated user, including Record and Scope users, can exploit this to bypass table-level permission checks and read the full contents of any table within the database they are authenticated against. Data exfiltration is most direct when scripting functions are enabled via the --allow-scripting flag, but it is also possible using the THROW statement or timing-based side channels. This issue is confined to the current database and does not cross namespace or database isolation boundaries.

Recommendations Update to version 3.1.0 or later. Disable scripting functions by removing the -A or --allow-scripting flag to block the most direct exfiltration method. Restrict the ability of untrusted principals to execute arbitrary SELECT queries with user-controlled WHERE clauses. Use namespace or database isolation as the primary security boundary instead of table-level permissions.