CVE-2026-63751: SurrealDB Auth Bypass Vulnerability

CVE-2026-63751 Overview

CVE-2026-63751 is a field-level permission bypass vulnerability in SurrealDB versions before 3.1.0. The flaw exists in how the database processes JSON Patch operations submitted through UPDATE PATCH statements. Authenticated users can supply a copy or move operation with an empty from pointer, causing SurrealDB to duplicate every field of a record — including fields protected by field-level SELECT permissions — into an attacker-controlled destination field. Reading the destination field then returns data the user was never authorized to see. The issue is classified under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated attackers can read confidentiality-restricted fields by exfiltrating them into attacker-writable fields through a malformed JSON Patch.

Affected Products

SurrealDB versions prior to 3.1.0
Deployments exposing UPDATE PATCH to authenticated but non-privileged users
Applications relying on field-level SELECT permissions to enforce data confidentiality

Discovery Timeline

2026-07-20 - CVE-2026-63751 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63751

Vulnerability Analysis

SurrealDB supports RFC 6902 JSON Patch semantics via the UPDATE ... PATCH statement. JSON Patch defines six operations, including copy and move, both of which take a from JSON Pointer identifying the source location. When from is set to the empty string (""), RFC 6902 defines this as a reference to the root of the target document — in SurrealDB's case, the entire record.

SurrealDB evaluates field-level SELECT permissions when a client reads a named field, but it does not re-evaluate those permissions when a copy or move operation duplicates the whole record body into a new field. As a result, protected fields are silently copied into the destination field, which the caller can then read normally. This breaks the confidentiality boundary that field-level permissions are intended to enforce.

Root Cause

The root cause is missing authorization enforcement inside the JSON Patch evaluator. The evaluator treats the record root as a single value and moves or copies it verbatim, without iterating through its constituent fields to check each one against the caller's SELECT permissions. Field-level access control is applied at query projection time, not at patch time, so the check is bypassed.

Attack Vector

An authenticated user with permission to UPDATE a record — but without permission to SELECT one or more protected fields on that record — submits a patch that copies the record root into an attacker-writable field. A representative payload takes the form of an UPDATE record:id PATCH [{ "op": "copy", "from": "", "path": "/leak" }] statement, after which a follow-up SELECT leak FROM record:id returns the full record contents, including previously restricted fields. The equivalent move operation produces the same disclosure. Exploitation requires only network access to the SurrealDB endpoint and low-privilege authenticated credentials.

No public proof-of-concept exploit or CISA KEV listing has been recorded, and the current EPSS probability is 0.173%.

Detection Methods for CVE-2026-63751

Indicators of Compromise

UPDATE ... PATCH statements in query logs containing a copy or move operation with "from": ""
New or unexpected fields appearing on records after patch operations, especially fields whose names do not match the application schema
Follow-up SELECT queries from the same session that read those newly created fields
Repeated patch-then-select access patterns originating from low-privileged database roles

Detection Strategies

Parse SurrealDB query logs for JSON Patch payloads and alert on any copy or move operation whose from pointer is empty or resolves to the record root
Baseline the set of fields each application role legitimately writes, and flag deviations that introduce arbitrary field names via PATCH
Correlate a PATCH event with a subsequent SELECT of the newly written field by the same principal within a short time window

Monitoring Recommendations

Forward SurrealDB audit and query logs to a centralized analytics platform for retention and correlation
Track authentication events by role, and monitor accounts whose activity begins including PATCH operations against records containing sensitive fields
Alert on privilege-boundary anomalies, such as a role that has never previously read a protected field starting to return field values in query results

How to Mitigate CVE-2026-63751

Immediate Actions Required

Upgrade SurrealDB to version 3.1.0 or later on all cluster nodes and client libraries
Audit existing records for fields that do not match the declared schema and may contain copied sensitive data
Rotate any secrets or tokens stored in fields that were reachable through vulnerable PATCH operations
Review database roles and remove UPDATE permission from principals that only require read access

Patch Information

SurrealDB addressed the issue in release 3.1.0. Details are published in the SurrealDB GitHub Security Advisory GHSA-fpxg-5xmv-922m and the VulnCheck Advisory on SurrealDB. Operators running earlier 3.x builds should plan an upgrade before re-enabling public authenticated access.

Workarounds

Restrict use of the UPDATE ... PATCH statement to trusted service accounts through role-based permissions until the upgrade is complete
At the application layer, reject client-supplied JSON Patch documents that contain copy or move with an empty or root from pointer
Move highly sensitive fields into a separate table protected by table-level permissions rather than relying solely on field-level SELECT rules

bash

# Verify the running SurrealDB version and confirm it is patched
surreal version

# Example: revoke PATCH-capable UPDATE from a low-privilege role until upgrade
DEFINE TABLE record SCHEMAFULL PERMISSIONS
  FOR select, update WHERE $auth.role = 'service'
  FOR select WHERE $auth.role = 'reader';