CVE-2026-63745 — SurrealDB before 3.1.0 Authorization Bypass via Composite Record-id
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fi…
Published: 2026-07-20 · CVSS: 5.3 · CVSS 4.0
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability where authenticated users can spoof composite record-id field values by writing to editable body fields. Attackers can bypass permission rules that gate access on id components like tenant isolation by setting same-named body fields to spoofed values that permission checks incorrectly read instead of the immutable id key.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7