Vulnerability Description
SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Surrealdb | Surrealdb | < 3.2.0 |
Related Weaknesses (CWE)
References
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-66r2-5gwj-gxm2Vendor AdvisoryMitigation
- https://www.vulncheck.com/advisories/surrealdb-before-permissions-bypass-via-perThird Party Advisory
FAQ
What is CVE-2026-63733?
CVE-2026-63733 is a vulnerability with a CVSS score of 4.3 (MEDIUM). SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to pe...
How severe is CVE-2026-63733?
CVE-2026-63733 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-63733?
Check the references section above for vendor advisories and patch information. Affected products include: Surrealdb Surrealdb.