CVE-2026-63752

Katalog CVE

CVSS 4.3 · Medium EPSS 0,28%

Kerentanan Improper Authorization pada surrealdb. Skor CVSS 3.1 4.3 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite the target record instead of rejecting the operation.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

22 Juli 2026

Status NVD

Analyzed

CVSS 3.1

4.3 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-285: Improper Authorization

EPSS (30 hari)

0,28% peluang dieksploitasi; lebih tinggi dari 18,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-f82j-v89j-mf86 advisory vendor · mitigasi
• https://www.vulncheck.com/advisories/surrealdb-before-relate-statement-record-overwrite advisory pihak ketiga