CVE-2026-63733

Katalog CVE

CVSS 6.5 · Medium EPSS 0,29%

Kerentanan Incorrect Authorization pada surrealdb. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

22 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,29% peluang dieksploitasi; lebih tinggi dari 19,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-66r2-5gwj-gxm2 advisory vendor · mitigasi
• https://www.vulncheck.com/advisories/surrealdb-before-permissions-bypass-via-permissions-clause advisory pihak ketiga