CVE-2026-63751 SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch

What is CVE-2026-63751?

CVE-2026-63751 is a medium-severity missing authorization vulnerability in Surrealdb Surrealdb, published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including those restricted by field-level SELECT permissions, into attacker-chosen destination fields.

Weakness: CWE-863

Which versions are affected by CVE-2026-63751?

2 open source packages ship an affected version, including surrealdb. It affects 1 product.

Products include Surrealdb Surrealdb.

How do I fix CVE-2026-63751?

Upgrade surrealdb to 3.1.0 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-63751 being exploited?

There is no known exploitation of CVE-2026-63751 in the wild and no public exploit code.

Other vulnerabilities in Surrealdb Surrealdb

• CVE-2025-71392 SurrealDB before 2.2.2 SurrealQL Injection via export Critical 9.4
• CVE-2026-63756 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition Critical 9.2
• CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use High 8.7
• CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions High 8.7
• CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser High 8.7

All Surrealdb Surrealdb vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fpxg-5xmv-922m.