CVE-2026-63756 — SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated sessio…
Published: 2026-07-20 · CVSS: 9.2 · CVSS 4.0
SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated traffic is active to execute operations with hijacked user privileges.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7