CVE-2026-63738

Katalog CVE

CVSS 4.3 · Medium EPSS 0,28%

Kerentanan Incorrect Authorization pada surrealdb. Skor CVSS 3.1 4.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph traversals instead of direct table scans.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

22 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 19,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-hv6h-hc26-q48p advisory vendor · mitigasi
• https://www.vulncheck.com/advisories/surrealdb-before-field-permission-bypass-via-traversal advisory pihak ketiga