CVE-2026-63748 SurrealDB before 3.1.0 Information Disclosure via Error Messages
Authenticated users can bypass field-level access controls to read hidden data via error messages in SurrealDB.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63748?
CVE-2026-63748 is a medium-severity vulnerability in Surrealdb Surrealdb, published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw operand values in error responses, bypassing field-level access controls.
Weakness: CWE-209
Which versions are affected by CVE-2026-63748?
2 open source packages ship an affected version, including surrealdb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
surrealdb crates.io | All versions | 3.1.0 |
surrealdb crates.io | All versions | 3.1.0 |
Products include Surrealdb Surrealdb.
How do I fix CVE-2026-63748?
Upgrade surrealdb to 3.1.0 or later.
Is CVE-2026-63748 being exploited?
There is no known exploitation of CVE-2026-63748 in the wild and no public exploit code.
Other vulnerabilities in Surrealdb Surrealdb
- CVE-2025-71392 SurrealDB before 2.2.2 SurrealQL Injection via export
- CVE-2026-63756 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
- CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use
- CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
- CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser
Sources
Also known as GHSA-6g9v-7gq3-p2c6.