CVE-2026-63752: SurrealDB Auth Bypass Vulnerability

CVE-2026-63752 Overview

CVE-2026-63752 is an authorization bypass vulnerability in SurrealDB versions before 3.1.0. The flaw resides in the RELATE statement, which fails to enforce UPDATE permission when a SET id clause targets an existing edge record. Authenticated users holding only CREATE permission can overwrite existing graph edges by issuing a crafted RELATE statement. The storage layer silently replaces the target record instead of rejecting the operation. The weakness is categorized as improper authorization [CWE-285] and affects the integrity of graph relationship data stored in SurrealDB.

Critical Impact
Authenticated users with CREATE permission can silently overwrite existing edge records in SurrealDB, corrupting graph relationships without triggering an authorization error.

Affected Products

SurrealDB versions prior to 3.1.0
Deployments exposing the SurrealDB query interface to authenticated tenants
Applications relying on SurrealDB graph edges for access control or referential integrity

Discovery Timeline

2026-07-20 - CVE-2026-63752 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63752

Vulnerability Analysis

SurrealDB's RELATE statement creates edge records that connect two nodes in the graph model. The statement is intended solely for edge creation and should therefore require CREATE permission on the target table. The vulnerability occurs when a user appends a SET id clause referencing an existing edge identifier. Instead of verifying that the caller holds UPDATE permission on the pre-existing record, the storage layer performs an unchecked write. The target edge is silently overwritten with attacker-controlled fields, including in, out, and arbitrary content properties. The operation returns success, leaving no authorization error in application logs. The result is an integrity violation on graph edges that other application logic may treat as trusted.

Root Cause

The root cause is missing authorization enforcement in the code path that handles RELATE ... SET id = <existing_id>. The permission check evaluates only the CREATE action on the edge table. It does not detect that the specified id collides with an existing record, which would require the UPDATE action. The storage layer treats the write as an upsert rather than an insert, producing a silent overwrite [CWE-285].

Attack Vector

Exploitation requires a valid authenticated session with CREATE privilege on any edge table the attacker wishes to modify. The attacker submits a RELATE query over the standard SurrealDB network interface, supplying the identifier of the target edge in a SET id clause along with replacement in, out, and property values. No user interaction is required, and the attack complexity is low. The impact is limited to the integrity of edge records; confidentiality and availability are not directly affected. See the GitHub Security Advisory GHSA-f82j-v89j-mf86 and the VulnCheck Advisory for a detailed reproduction path.

Detection Methods for CVE-2026-63752

Indicators of Compromise

RELATE statements in query logs containing a SET id clause that references pre-existing edge identifiers.
Unexpected modifications to in, out, or content fields on edge records that were not accompanied by an UPDATE statement.
Application-level integrity checks failing on graph edges without a corresponding administrative change record.

Detection Strategies

Enable SurrealDB query auditing and search for RELATE operations that include an explicit id assignment.
Compare edge record timestamps and content hashes against a known-good baseline to identify silent overwrites.
Correlate authenticated session identifiers with edge modifications to detect users writing outside their expected permission scope.

Monitoring Recommendations

Forward SurrealDB access and query logs to a centralized log platform for continuous review.
Alert on any RELATE statement issued by accounts that hold CREATE but not UPDATE permission on the affected table.
Monitor for spikes in edge record write operations that do not originate from expected application workflows.

How to Mitigate CVE-2026-63752

Immediate Actions Required

Upgrade SurrealDB to version 3.1.0 or later on all cluster nodes and standalone instances.
Review existing role and permission definitions to confirm that untrusted users do not hold CREATE on sensitive edge tables.
Audit edge records created or modified before the patch for signs of unauthorized overwrite.

Patch Information

SurrealDB addressed the issue in version 3.1.0 by adding an authorization check that requires UPDATE permission whenever a RELATE statement targets an existing edge identifier. Refer to the GitHub Security Advisory GHSA-f82j-v89j-mf86 for release details.

Workarounds

Restrict CREATE permission on edge tables to trusted service accounts until the upgrade is applied.
Enforce query filtering at the application layer to reject RELATE statements that include an explicit id field.
Use separate database namespaces to isolate tenants whose RELATE privileges cannot be immediately revoked.

bash

# Configuration example: restrict RELATE-capable roles at the schema level
DEFINE TABLE follows SCHEMAFULL
  PERMISSIONS
    FOR create WHERE $auth.role = 'service'
    FOR update WHERE $auth.role = 'service'
    FOR select WHERE $auth.id != NONE;