CVE-2026-63763 Overview
CVE-2026-63763 is a confused deputy privilege escalation vulnerability in SurrealDB versions before 2.5.0 and before 3.0.0-beta.3. Unprivileged users with roles such as database editor can create or modify fields containing futures, functions, or closures. These constructs execute in the context of the querying user rather than the creator. An attacker plants malicious logic in a record, and when a higher-privileged user reads or writes that record, the code runs with the victim's permissions. The flaw is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Successful exploitation allows a low-privileged database user to escalate to root owner, enabling full server takeover of the SurrealDB instance.
Affected Products
- SurrealDB versions prior to 2.5.0
- SurrealDB 3.0.0-alpha1 through 3.0.0-alpha18
- SurrealDB 3.0.0-beta1 and 3.0.0-beta2
Discovery Timeline
- 2026-07-20 - CVE-2026-63763 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-63763
Vulnerability Analysis
SurrealDB supports embedded computed expressions inside record fields, including futures, functions, and closures. These expressions are evaluated lazily at query time rather than at creation time. The engine executes them using the session context of the user issuing the read or write, not the user who wrote the expression into the field.
This mismatch between the code author and the execution principal creates a classic confused deputy condition. A low-privileged user who has write access to a table or record can inject SurrealQL logic that runs later with elevated authority. When a root or owner-level user queries the record, the planted expression executes under their permissions and can perform privileged actions such as creating new root accounts.
Root Cause
The underlying flaw is an authorization model gap. SurrealDB evaluates stored expressions with the invoker's permissions, but the platform does not restrict the ability to plant those expressions to privileged principals. Field definitions and record values containing executable constructs are treated as data rather than code subject to authorization checks at write time.
Attack Vector
An authenticated attacker with editor-level access on a database creates or modifies a field, closure, or future within a record they can write to. The attacker embeds SurrealQL statements that, for example, create a new user with root owner privileges. The attacker then waits for or induces a higher-privileged user to read or write the affected record. Once the victim touches the record, the injected logic executes and completes the privilege escalation. See the SurrealDB GitHub Security Advisory and the VulnCheck Security Advisory for additional technical detail.
// No verified proof-of-concept code is published.
// See the SurrealDB GHSA-3v2x-9xcv-2v2v advisory for technical details.
Detection Methods for CVE-2026-63763
Indicators of Compromise
- Unexpected creation of root or owner-level accounts in SurrealDB user tables shortly after low-privileged users modify records or field definitions.
- Field definitions or records containing SurrealQL futures, fn::, or closure expressions authored by non-administrative accounts.
- Anomalous privilege changes or DEFINE USER statements executed as part of routine read queries by admin users.
Detection Strategies
- Audit SurrealDB query and schema change logs for DEFINE FIELD, UPDATE, and CREATE statements from editor-level users that introduce futures, functions, or closures.
- Compare current schema definitions against known-good baselines to identify fields whose value expressions reference administrative actions.
- Correlate low-privilege write events with subsequent privileged actions performed by admin sessions to identify confused deputy activity.
Monitoring Recommendations
- Forward SurrealDB server logs and audit events to a centralized logging platform and alert on DEFINE USER or role-changing statements executed outside change-control windows.
- Track record-level writes from non-administrative principals to sensitive tables, especially where field values contain executable expressions.
- Monitor authentication events for new root or owner accounts and validate them against approved provisioning tickets.
How to Mitigate CVE-2026-63763
Immediate Actions Required
- Upgrade SurrealDB to version 2.5.0 or later on the 2.x branch, or to 3.0.0-beta.3 or later on the 3.x branch.
- Review all existing field definitions, records, and closures for embedded futures or functions authored by non-administrative users and remove untrusted expressions.
- Rotate credentials for root and owner accounts and audit user tables for unauthorized privileged accounts created since deployment.
Patch Information
SurrealDB addressed the vulnerability in releases 2.5.0 and 3.0.0-beta.3. Refer to the SurrealDB GitHub Security Advisory GHSA-3v2x-9xcv-2v2v for the official fix details and release notes.
Workarounds
- Restrict write access on databases and tables to trusted administrative users until the upgrade is applied.
- Avoid using editor or equivalent low-privilege roles on production databases where administrative users routinely query the same records.
- Have privileged users query records in read-only sessions with reduced authority where operationally feasible, minimizing the impact of any executed expressions.
# Verify installed SurrealDB version and upgrade
surreal version
# Example upgrade via the official installer
curl -sSf https://install.surrealdb.com | sh -s -- --version v2.5.0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
