CVE-2026-63763 | SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a co… | CVSS 7.5 HIGH

Description

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database editor role) can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the invoking/querying user rather than their creator, an attacker can plant malicious logic that executes with a higher-privileged user's permissions when that user reads or writes the affected record. This can lead to full privilege escalation, including creation of a root owner and server takeover.

Metadata

CVE ID: CVE-2026-63763
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-18 12:34 UTC
Published: 2026-07-20 12:04 UTC
Last updated: 2026-07-20 15:46 UTC
Primary CWE: CWE-639
Authorization Bypass Through User-Controlled Key
Vendor / Product: surrealdb / surrealdb
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: total

Affected products (2)

Vendor	Product	Platform	Versions
surrealdb	surrealdb	—	0 < 2.5.0, 2.5.0
surrealdb	surrealdb	—	0 < 3.0.0-beta.3, 3.0.0-beta.3

Weakness (CWE)

CWE	Source	Description
CWE-639	cna	Authorization Bypass Through User-Controlled Key

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)

GitHub Security Advisory (GHSA-3v2x-9xcv-2v2v) https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3v2x-9xcv-2v2v
VulnCheck Advisory: SurrealDB before 2.5.0 Privilege Escalation via Future Fields https://www.vulncheck.com/advisories/surrealdb-before-privilege-escalation-via-future-fields