{"id":"EUVD-2026-45926","enisaUuid":"7cdae62e-c896-33cc-83d7-f71a662676be","description":"SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements) against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user — including Record and Scope users — can exploit this ordering flaw to read the full contents of any table in the database they are authenticated against, bypassing table-level permission checks. Exfiltration is most direct when scripting functions are enabled (--allow-scripting), but is also possible via SurrealQL\u0027s THROW statement and timing-based side channels without scripting. The vulnerability is confined to the attacker\u0027s current database and does not cross namespace or database isolation boundaries.","datePublished":"Jul 20, 2026, 12:04:46 PM","dateUpdated":"Oct 8, 2026, 3:23:50 PM","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-98fx-66cf-fc7c\nhttps://www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-where-clause\n","aliases":"CVE-2026-63755\nGHSA-4f9v-jpx9-mjvw\n","assigner":"VulnCheck","epss":0.36,"enisaIdProduct":[{"id":"2e201291-52fe-347a-a4bf-012835cc0c99","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c3.1.0"}],"enisaIdVendor":[{"id":"3e965e6f-2fb4-3f6a-9b8f-e0a1a22593d7","vendor":{"name":"surrealdb"}}],"enisaIdVulnerability":[{"id":"a426c675-4f8a-3e7a-9adf-4c08aacd2716","vulnerability":{"id":"GHSA-4f9v-jpx9-mjvw","description":"Duplicate Advisory: SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level","datePublished":"Jul 20, 2026, 12:33:10 PM","dateUpdated":"Sep 4, 2026, 8:21:48 PM","baseScore":0.0,"references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-98fx-66cf-fc7c\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63755\nhttps://www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-where-clause\n","enisa_id":"EUVD-2026-45926\n","aliases":"GHSA-4f9v-jpx9-mjvw\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:02:28 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e292237e-160e-398a-81af-6cc12caed06d","vulnerability":{"id":"CVE-2026-63755","description":"SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements (and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements) against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An authenticated user — including Record and Scope users — can exploit this ordering flaw to read the full contents of any table in the database they are authenticated against, bypassing table-level permission checks. Exfiltration is most direct when scripting functions are enabled (--allow-scripting), but is also possible via SurrealQL\u0027s THROW statement and timing-based side channels without scripting. The vulnerability is confined to the attacker\u0027s current database and does not cross namespace or database isolation boundaries.","datePublished":"Jul 20, 2026, 12:04:46 PM","dateUpdated":"Oct 8, 2026, 3:23:50 PM","status":"PUBLISHED","baseScore":7.1,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-98fx-66cf-fc7c\nhttps://www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-where-clause\n","enisa_id":"EUVD-2026-45926\n","assigner":"VulnCheck","epss":0.36,"dataProcessed":"Nov 1, 2026, 7:16:30 AM","vulnerabilityProduct":[{"id":"b75bccb3-d498-340a-b813-1b552d9e5f7b","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c3.1.0"}],"vulnerabilityVendor":[{"id":"56868f55-da07-378a-9158-5b846045a787","vendor":{"name":"surrealdb"}}]}}],"enisaIdAdvisory":[]}