CVE-2026-63740 Overview
CVE-2026-63740 is a broken access control vulnerability [CWE-863] affecting SurrealDB versions before 3.1.4. The flaw resides in the SELECT permission enforcement for array elements using the field.* syntax. Instead of hiding array elements that record-scoped users lack permission to view, the database leaks those denied elements in query responses. Attackers authenticated with record scope access can read protected array elements by exploiting incorrect index handling during permission filtering. The issue affects multi-tenant deployments that rely on element-level array permissions to segregate data between record users.
Critical Impact
Authenticated record-scoped users can bypass field-level array permissions to read confidential data that element-level access controls were configured to deny.
Affected Products
- SurrealDB versions prior to 3.1.4
- Deployments using record-scope authentication with field.* permission rules
- Multi-tenant SurrealDB instances relying on element-level array filtering
Discovery Timeline
- 2026-07-20 - CVE-2026-63740 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-63740
Vulnerability Analysis
SurrealDB supports fine-grained permissions on document fields, including individual elements within arrays via the field.* syntax. When a SELECT query executes against a record containing an array, the engine iterates each element and evaluates the configured permission rule. Versions before 3.1.4 handle array indices incorrectly during this filtering step. The engine returns denied elements to the caller instead of removing or nullifying them.
The defect breaks the security model that record-scoped applications depend on. Applications that expose SurrealDB directly to end users, such as browser clients querying with scoped tokens, cannot rely on field.* permission clauses to segregate tenant data within shared arrays.
Root Cause
The root cause is incorrect index handling inside the permission filter that processes field.* rules. The filter evaluates the permission expression per element but fails to strip or mask elements that resolve to a denied state. The vulnerability is classified under CWE-863: Incorrect Authorization.
Attack Vector
An attacker requires only record-scope credentials to the target SurrealDB instance. The attacker issues a standard SELECT query against a table that contains an array field protected by an element-level permission rule. Because the flaw sits in the query result assembly, no specially crafted payload or injection technique is required. The vulnerability is network-exploitable and requires low privileges with no user interaction. See the SurrealDB GHSA-8rw6-p7m8-63jp advisory and the VulnCheck advisory for full technical detail.
Detection Methods for CVE-2026-63740
Indicators of Compromise
- Record-scoped sessions issuing SELECT queries that reference array fields protected by field.* permission clauses.
- Query responses that return array elements to a record user whose permissions should deny those elements.
- SurrealDB server version reporting a release earlier than 3.1.4 in banner or health endpoints.
Detection Strategies
- Audit DEFINE FIELD statements for any use of field.* permission rules and correlate them with query logs from record-scoped tokens.
- Compare query results returned to record users against the expected permission-filtered result set in a staging environment.
- Enumerate running SurrealDB instances across the environment and flag any build below 3.1.4.
Monitoring Recommendations
- Forward SurrealDB query and authentication logs to a centralized data lake for retention and correlation with authentication events.
- Alert on anomalous read volume from record-scoped tokens targeting tables that contain sensitive array fields.
- Track privileged schema changes to DEFINE FIELD and DEFINE TABLE statements that adjust PERMISSIONS FOR select.
How to Mitigate CVE-2026-63740
Immediate Actions Required
- Upgrade all SurrealDB deployments to version 3.1.4 or later.
- Rotate record-scope tokens issued while vulnerable versions were in production if sensitive array data was accessible.
- Review application code that relies on field.* permission clauses and validate that server-side responses match expected access boundaries.
Patch Information
SurrealDB released a fix in version 3.1.4. The corrected permission filter properly removes denied elements during array processing. Refer to the GitHub Security Advisory GHSA-8rw6-p7m8-63jp for release notes and patch details.
Workarounds
- Move sensitive per-element data out of shared arrays into separate records protected by row-level PERMISSIONS.
- Restrict record-scope access to tables that contain arrays governed by field.* rules until the upgrade completes.
- Apply application-tier filtering to strip denied elements from responses before returning data to end users.
# Verify installed SurrealDB version and upgrade
surreal version
# Docker upgrade example
docker pull surrealdb/surrealdb:v3.1.4
docker stop surrealdb && docker rm surrealdb
docker run --rm -p 8000:8000 surrealdb/surrealdb:v3.1.4 start
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
