CVE-2026-63733: SurrealDB Auth Bypass Vulnerability

CVE-2026-63733 Overview

CVE-2026-63733 is a permissions bypass vulnerability affecting SurrealDB versions before 3.2.0. The flaw allows authenticated users to write to tables they lack permission to modify. Data-modifying statements embedded within PERMISSIONS clauses execute with permission enforcement disabled. Attackers with access to any guarded operation can embed CREATE, UPDATE, DELETE, or UPSERT statements inside the PERMISSIONS clause. These embedded statements bypass access controls and produce unintended writes and data corruption. The issue is categorized under CWE-863 as incorrect authorization.

Critical Impact
Low-privileged authenticated users can bypass table-level access controls to modify data outside their authorization scope, leading to data corruption.

Affected Products

SurrealDB versions prior to 3.2.0
Deployments exposing SurrealQL query interfaces to authenticated users
Applications relying on PERMISSIONS clauses for tenant or row isolation

Discovery Timeline

2026-07-20 - CVE-2026-63733 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63733

Vulnerability Analysis

SurrealDB uses PERMISSIONS clauses to declare row-level and table-level access rules. These clauses are evaluated when a session attempts a guarded operation such as SELECT, CREATE, UPDATE, or DELETE. The vulnerability arises because SurrealDB evaluates the expression inside the PERMISSIONS clause with permission enforcement disabled. Any data-modifying statement embedded in that clause therefore executes as a privileged operation.

An attacker with permission to perform a guarded action on one table can nest arbitrary write statements inside the associated PERMISSIONS expression. Those nested statements bypass authorization checks against the target tables. This grants write access to resources the attacker does not otherwise control. Full technical background is available in the GitHub Security Advisory GHSA-66r2-5gwj-gxm2 and the VulnCheck Advisory on SurrealDB.

Root Cause

The root cause is a scope-of-enforcement error. SurrealQL disables permission checks while resolving expressions in a PERMISSIONS clause to prevent recursive evaluation. However, the engine does not restrict those expressions to read-only or side-effect-free statements. Embedded write operations therefore execute in a privileged context.

Attack Vector

Exploitation requires network access to the SurrealDB query endpoint and low-privileged authenticated credentials. The attacker must be able to perform at least one guarded operation whose PERMISSIONS clause is evaluated on their behalf. By embedding CREATE, UPDATE, DELETE, or UPSERT statements inside that clause, the attacker triggers writes against tables they do not own. No user interaction is required. The EPSS score is 0.201% with a percentile of 10.259.

The exploitation pattern involves crafting a SurrealQL statement whose PERMISSIONS expression contains a nested data-modifying statement. When the database evaluates the outer operation, it silently executes the nested write without applying authorization checks. Refer to the vendor advisory for concrete SurrealQL syntax examples.

Detection Methods for CVE-2026-63733

Indicators of Compromise

Unexpected writes to tables from user sessions that lack declared write permissions on those tables
SurrealDB query logs showing PERMISSIONS clauses containing CREATE, UPDATE, DELETE, or UPSERT keywords
Divergence between application-level audit trails and SurrealDB record change timestamps
New or modified records attributed to low-privileged user tokens

Detection Strategies

Parse SurrealDB query logs for PERMISSIONS clauses that include data-modifying statement keywords
Compare the executing session's role against the target table's declared write permissions for every mutation event
Alert on any query where the PERMISSIONS expression syntax tree contains write operations
Correlate authenticated session identifiers with tables modified during each request

Monitoring Recommendations

Enable verbose query logging on SurrealDB and forward logs to a centralized analytics platform
Baseline normal PERMISSIONS clause content per schema and alert on deviations
Monitor record counts and checksums on sensitive tables for unexplained changes
Review authentication logs alongside write events to attribute mutations to specific principals

How to Mitigate CVE-2026-63733

Immediate Actions Required

Upgrade SurrealDB to version 3.2.0 or later on all instances
Audit existing PERMISSIONS clauses across all tables and remove any embedded data-modifying statements
Rotate credentials for any low-privileged accounts that may have been abused
Review record histories on tables containing dynamic PERMISSIONS expressions for unauthorized changes

Patch Information

SurrealDB addressed the issue in version 3.2.0. The fix is documented in GitHub Security Advisory GHSA-66r2-5gwj-gxm2. Operators should plan an upgrade window and verify version strings after deployment.

Workarounds

Restrict SurrealDB authenticated access to trusted service accounts until the upgrade is complete
Remove or simplify PERMISSIONS clauses so they contain only read-only boolean expressions
Place a query proxy in front of SurrealDB that rejects statements containing nested write keywords inside PERMISSIONS clauses
Isolate multi-tenant deployments into separate SurrealDB namespaces to limit blast radius

bash

# Verify installed SurrealDB version and confirm patched release
surreal version

# Expected output should indicate 3.2.0 or later
# surreal 3.2.0 for linux on x86_64