CVE-2026-63738 Overview
CVE-2026-63738 is a broken access control vulnerability [CWE-863] in SurrealDB, a multi-model database supporting graph, document, and relational workloads. Versions from 3.1.0 up to but not including 3.1.5 fail to enforce field-level SELECT permissions when records are materialized through graph-edge or back-reference traversals. An authenticated user with table-level SELECT access can retrieve field values that field-level permissions were configured to hide. The vulnerability affects confidentiality only and requires low privileges to exploit over the network.
Critical Impact
Authenticated users can bypass field-level SELECT permissions by traversing graph edges or back-references, exposing protected field values in SurrealDB deployments running versions 3.1.0 through 3.1.4.
Affected Products
- SurrealDB 3.1.0
- SurrealDB versions 3.1.1 through 3.1.4
- Fixed in SurrealDB 3.1.5
Discovery Timeline
- 2026-07-20 - CVE-2026-63738 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-63738
Vulnerability Analysis
SurrealDB supports layered permissions where administrators grant table-level SELECT access and then restrict individual fields with field-level permission clauses. This model assumes the field-level checks apply consistently regardless of how a record is reached. The vulnerability breaks that assumption. When a record is materialized through a graph traversal or back-reference rather than a direct table scan, the query planner skips the field-level authorization step and returns the underlying field values to the caller.
The flaw undermines the confidentiality guarantees of least-privilege schema design in multi-tenant applications built on SurrealDB. Sensitive attributes such as password hashes, personally identifiable information, financial fields, or internal identifiers can be surfaced by any user who already holds table-level read access on a related table.
Root Cause
The root cause is an incomplete authorization path in the query execution layer. Field-level SELECT permissions are evaluated during direct record access but are not applied when records are produced as the target of a graph edge traversal (for example, ->edge->target) or through back-reference expressions. The permission check is coupled to the access path rather than to the record and field being returned, which is the pattern identified by CWE-863 (Incorrect Authorization).
Attack Vector
An attacker authenticates to the SurrealDB instance with any account that has legitimate table-level SELECT access. Instead of issuing a direct SELECT query against the protected table, the attacker issues a query that reaches the target records through a graph traversal or a back-reference from a related table. Fields that would normally be filtered by field-level permissions are returned in the result set. Exploitation requires only network access to the database endpoint and valid low-privilege credentials, and it produces no memory corruption or availability impact. Refer to the GitHub Security Advisory GHSA-hv6h-hc26-q48p and the VulnCheck Advisory for technical details.
Detection Methods for CVE-2026-63738
Indicators of Compromise
- Query logs containing graph-edge traversals (->, <-) or back-reference expressions that target tables holding fields protected by PERMISSIONS FOR select clauses.
- Result sets returned to low-privilege sessions that include fields those sessions cannot retrieve through direct table SELECT queries.
- Repeated traversal queries from a single session enumerating related records across sensitive tables.
Detection Strategies
- Enable SurrealDB query auditing and compare fields returned via traversal queries against the fields each role is authorized to read directly.
- Baseline expected traversal patterns per application role and alert on deviations that reach tables containing hidden fields.
- Correlate authentication events with query patterns to identify accounts issuing traversal queries they have not previously used.
Monitoring Recommendations
- Ship SurrealDB query and audit logs to a centralized analytics platform for long-term retention and cross-session correlation.
- Track the SurrealDB server version in asset inventories and flag any host still running 3.1.0 through 3.1.4.
- Monitor egress volume from the database tier for unexpected spikes that may indicate bulk enumeration through traversals.
How to Mitigate CVE-2026-63738
Immediate Actions Required
- Upgrade SurrealDB to version 3.1.5 or later on all affected instances.
- Inventory schemas that rely on field-level SELECT permissions and review recent query logs for traversal-based access to those fields.
- Rotate credentials or secrets stored in fields that were protected by field-level permissions and may have been exposed.
Patch Information
SurrealDB 3.1.5 resolves the issue by enforcing field-level SELECT permissions on records materialized through graph traversals and back-references. The fix is documented in the SurrealDB Security Advisory GHSA-hv6h-hc26-q48p. Apply the upgrade following SurrealDB's standard release procedure and validate that dependent applications continue to function after the permission model is tightened.
Workarounds
- Restrict database accounts so that users who must not read hidden fields also lack SELECT access on tables that are reachable through graph edges pointing to those records.
- Remove or redesign graph edges and back-references that terminate on tables containing fields protected by field-level SELECT permissions until the upgrade is applied.
- Place the SurrealDB endpoint behind network controls that limit access to trusted application tiers, reducing the number of accounts that could abuse the traversal path.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
