Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-63763: SurrealDB lets low‑level users gain admin rights
CVE-2026-63763 · published 3 months ago
Summary
In versions of SurrealDB before 2.5.0, a normal database editor can add special data that runs code when a higher‑privilege user accesses it. This means the editor can cause actions to run as an administrator, potentially taking full control of the server. Update SurrealDB to version 2.5.0 or later, or apply the vendor's recommended patch, and review any custom fields for unexpected code.
What to do
- Update tobiemh surrealdb to version 2.5.0.
- Update tobiemh surrealdb to version 3.0.0-beta.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rust | tobiemh | surrealdb |
< 2.5.0 >= 3.0.0-alpha.1, < 3.0.0-beta.3 Fix: upgrade to 2.5.0
|
Original advisory text
SurrealDB before 2.5.0 Privilege Escalation via Future Fields
SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database editor role) can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the invoking/querying user rather than their creator, an attacker can plant malicious logic that executes with a higher-privileged user's permissions when that user reads or writes the affected record. This can lead to full privilege escalation, including creation of a root owner and server takeover.
References
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3v2x-9xcv-2v2v Vendor Advisory
- https://github.com/surrealdb/surrealdb/commit/f515c91363ee735aa1bc08580d9e7fa0de...
- https://github.com/surrealdb/surrealdb/releases/tag/v2.5.0
- https://github.com/surrealdb/surrealdb/releases/tag/v3.0.0-beta.2
- https://github.com/advisories/GHSA-3v2x-9xcv-2v2v
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63763... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-63763 Vendor Advisory
- https://www.vulncheck.com/advisories/surrealdb-before-privilege-escalation-via-f... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.4
Critical
Type
CWE-441Unintended Proxy or Intermediary ('Confused Deputy')
CWE-639Authorization Bypass Through User-Controlled Key
Timeline
Published20 Jul 2026
Updated21 Oct 2026
First seen6 Mar 2026
Track software like this
Free during beta