{"id":"EUVD-2026-45916","enisaUuid":"c762e047-5782-3d62-9ab2-2f81e42b0679","description":"SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-named body fields to spoofed values that permission checks incorrectly read instead of the immutable id key.","datePublished":"Jul 20, 2026, 12:04:38 PM","dateUpdated":"Oct 8, 2026, 3:23:46 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6vg3-hgrw-p5gf\nhttps://www.vulncheck.com/advisories/surrealdb-before-authorization-bypass-via-composite-record-id\n","aliases":"CVE-2026-63745\nGHSA-6fpj-mjq4-fp9r\n","assigner":"VulnCheck","epss":0.25,"enisaIdProduct":[{"id":"ab9feeb7-e6b5-3e73-8e4d-08baf8692539","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c3.1.0"}],"enisaIdVendor":[{"id":"5cd6d4da-99f8-3bbf-99da-6c8af6d68976","vendor":{"name":"surrealdb"}}],"enisaIdVulnerability":[{"id":"30305d72-f20e-3d4f-b699-cf81004e831c","vulnerability":{"id":"GHSA-6fpj-mjq4-fp9r","description":"SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-named body fields to spoofed values that permission checks incorrectly read instead of the immutable id key.","datePublished":"Jul 20, 2026, 12:33:09 PM","dateUpdated":"Jul 20, 2026, 12:33:09 PM","baseScore":0.0,"references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6vg3-hgrw-p5gf\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63745\nhttps://www.vulncheck.com/advisories/surrealdb-before-authorization-bypass-via-composite-record-id\n","enisa_id":"EUVD-2026-45916\n","aliases":"CVE-2026-63745\nGHSA-6fpj-mjq4-fp9r\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:50:23 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"549e53c8-9f43-3bce-85e6-1818d5fd366f","vulnerability":{"id":"CVE-2026-63745","description":"SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-named body fields to spoofed values that permission checks incorrectly read instead of the immutable id key.","datePublished":"Jul 20, 2026, 12:04:38 PM","dateUpdated":"Oct 8, 2026, 3:23:46 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6vg3-hgrw-p5gf\nhttps://www.vulncheck.com/advisories/surrealdb-before-authorization-bypass-via-composite-record-id\n","enisa_id":"EUVD-2026-45916\n","assigner":"VulnCheck","epss":0.25,"dataProcessed":"Nov 10, 2026, 7:37:02 AM","vulnerabilityProduct":[{"id":"fba0c378-865a-300d-b072-8815e2dd5dcc","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c3.1.0"}],"vulnerabilityVendor":[{"id":"205114fc-6e53-3afc-aa09-5d75e08d0675","vendor":{"name":"surrealdb"}}]}}],"enisaIdAdvisory":[]}