CVE-2026-63763

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.5.0 SurrealDB versions prior to 3.0.0-beta.3

Description A confused deputy privilege escalation issue exists where unprivileged users, such as those with the database editor role, can create or modify fields containing futures, functions, or closures. Since these elements are executed in the context of the user who invokes or queries them rather than the user who created them, an attacker can embed malicious logic. When a higher-privileged user reads or writes the affected record, the logic executes with their permissions, potentially leading to full privilege escalation, the creation of a root owner, and complete server takeover.

Recommendations Update to version 2.5.0 or later. Update to version 3.0.0-beta.3 or later.