https://vulnerability.circl.lu/sightings/feed 2026-09-13T23:14:49.529658+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/a506c4de-004f-4d07-aef8-e8d3e5f7f64b/export 2026-09-13T23:14:49.548625+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "a506c4de-004f-4d07-aef8-e8d3e5f7f64b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63733", "type": "seen", "source": "https://gist.github.com/alon710/e67772431cb25b3e742f3376d1f6891a", "content": "# CVE-2026-63733: CVE-2026-63733: Incorrect Authorization in SurrealDB Permissions Clause\n\n> **CVSS Score:** 4.3\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63733\n\n## Summary\nAn incorrect authorization vulnerability (CWE-863) in SurrealDB allows authenticated, low-privileged users to execute unauthorized state-modifying queries. This occurs because the database disabled permissions during evaluation of custom PERMISSIONS WHERE predicates to prevent infinite recursion.\n\n## TL;DR\nA design flaw in SurrealDB allows authenticated users to bypass read-only database permission rules, enabling unauthorized writes and data modification through nested permission queries.\n\n## Technical Details\n\n- **CWE ID**: CWE-863\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 4.3\n- **EPSS Score**: 0.00287\n- **Impact**: Incorrect Authorization (Integrity Bypass)\n- **Exploit Status**: None (No public exploit available)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- SurrealDB\n- **SurrealDB**: < 3.2.0 (Fixed in: `3.2.0`)\n\n## Mitigation\n\n- Upgrade database instances to SurrealDB 3.2.0 or newer.\n- Review existing user-defined functions and database schemas for state-modifying actions inside PERMISSIONS WHERE clauses.\n- Limit user access to critical schema configuration controls and restrict access roles to the absolute minimum necessary.\n\n**Remediation Steps:**\n1. Connect to the target SurrealDB database using administrative credentials.\n2. Execute `INFO FOR DB;` to export and extract all active schema configurations.\n3. Examine all `DEFINE TABLE`, `DEFINE FIELD`, and `DEFINE FUNCTION` directives for `PERMISSIONS ... WHERE` statements.\n4. Rewrite custom filters to use static, variable-based criteria (e.g. `$auth.id` comparison) instead of querying or calling stateful functions.\n5. Deploy SurrealDB version 3.2.0 via your standard container or package management pipeline.\n\n## References\n\n- [SurrealDB GitHub Security Advisory (GHSA-66r2-5gwj-gxm2)](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-66r2-5gwj-gxm2)\n- [VulnCheck Security Advisory](https://www.vulncheck.com/advisories/surrealdb-before-permissions-bypass-via-permissions-clause)\n- [SurrealDB v3.2.0 Release Notes](https://github.com/surrealdb/surrealdb/releases/tag/v3.2.0)\n- [CVE-2026-63733 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-63733)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63733) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T11:31:54.125388Z"} 2026-09-05T11:31:54.125388+00:00