Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

SurrealDB lets unauthorized users see hidden array items

CVE-2026-63740 · published 3 months ago
Summary

Versions of SurrealDB released before 3.1.4 do not correctly block access to individual items inside an array when a user’s permissions should hide them. This means someone with limited record access could still view data that was meant to be private. Updating SurrealDB to version 3.1.4 or later resolves the issue.

What to do
  • Update tobiemh surrealdb to version 3.1.4.
  • Update surrealdb to version 3.1.4.
  • Update surrealdb surrealdb to version 3.1.4 or later.
Affected software
Ecosystem VendorProductAffected versions
– surrealdb surrealdb < 3.1.4
rust tobiemh surrealdb <= 3.1.3
Fix: upgrade to 3.1.4
rust – surrealdb <= 3.1.3
Fix: upgrade to 3.1.4
Original advisory text
SurrealDB before 3.1.4 Array Element Permission Bypass
SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrect index handling during permission filtering.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published20 Jul 2026
Updated4 Nov 2026
First seen20 Jul 2026
Sources
CVE-2026-63740 · NVD
CVE-2026-63740 · MITRE
CVE-2026-63740 · OSV
Track software like this
Free during beta