Read the docs
TI-2026-45325 Aliases CVE-2026-63738GHSA-hv6h-hc26-q48p

SurrealDB 3.1.0 before 3.1.5 Field Permission Bypass via Traversal

Priority LOW 24CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph traversals instead of direct table scans.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00284 21st percentileScored 2026-11-07
Fix Fixed surrealdb (surrealdb): 3.1.5surrealdb (crates.io): 3.1.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
surrealdbsurrealdb3.1.0 to before 3.1.53.1.5Patch availableCNA
—surrealdb (crates.io)3.1.0 to before 3.1.53.1.5Patch availableGHSA-hv6h-hc26-q48p
  • surrealdb Vendorsurrealdb Affected 3.1.0 to before 3.1.5 Fixed in 3.1.5 Patch available CNA
  • surrealdb (crates.io) Vendor— Affected 3.1.0 to before 3.1.5 Fixed in 3.1.5 Patch available GHSA-hv6h-hc26-q48p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*3.1.0 to before 3.1.5Vulnerablesurrealdb
  • cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:* Versions 3.1.0 to before 3.1.5 Vulnerable ·surrealdb

Remediation

  • Fix · CNA surrealdb (surrealdb) Fixed in 3.1.5
  • Fix · GHSA-hv6h-hc26-q48p surrealdb (crates.io) Fixed in 3.1.5 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    surrealdb 3.1.5

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-45326 SurrealDB before 3.1.5 Arbitrary File Read via DEFINE ANALYZERPriority LOW 37
    • TI-2026-45324 SurrealDB before 3.1.5 Denial of Service via deep operator chainsPriority LOW 32
    • TI-2026-45331 SurrealDB before 3.1.5 SSRF via JWKS URL RedirectPriority LOW 23
    Show all 4 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63738
  2. 2026-10-03 Alias added: GHSA-hv6h-hc26-q48p

References

Advisory 2

Other 1

  • TI-2026-45344 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions CVSS 4.0HIGH 8.7
  • TI-2024-38452 SurrealDB before 1.1.0 Denial of Service via HTTP Headers CVSS 4.0HIGH 8.7
  • TI-2026-45347 SurrealDB before 3.1.0 Denial of Service via JSON Parser CVSS 4.0HIGH 8.7
  • TI-2026-45334 SurrealDB before 3.1.0 Denial of Service via malformed RPC use CVSS 4.0HIGH 8.7
  • TI-2025-43508 SurrealDB before 2.2.2 SurrealQL Injection via export CVSS 4.0CRITICAL 9.4
  • TI-2026-45343 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition CVSS 4.0CRITICAL 9.2
See all 54 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences