CVE-2026-63749 SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT

Medium 5.3 Published 20 Jul 2026 Updated 28 Jul 2026

Authenticated users can bypass SELECT permission checks in LIVE SELECT subscriptions to view hidden records by manipulating parameter bindings.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-63749?

CVE-2026-63749 is a medium-severity authentication bypass vulnerability in Surrealdb Surrealdb, published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $before, $after, or $event are evaluated against attacker-controlled bindings instead of actual documents. Authenticated subscribers can bind chosen values to these parameter names and register LIVE SELECT queries to receive notifications for records that SELECT permission expressions should have hidden.

Weakness: CWE-863

Which versions are affected by CVE-2026-63749?

It affects 1 product.

Products include Surrealdb Surrealdb.

How do I fix CVE-2026-63749?

No fix has been published for CVE-2026-63749 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-63749 being exploited?

There is no known exploitation of CVE-2026-63749 in the wild and no public exploit code.

All Surrealdb Surrealdb vulnerabilities

Sources

Also known as GHSA-75qw-w395-xvv7.