Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDATE, DELETE, or UPSERT statements in the PERMISSIONS clause, causing unintended writes and data corruption.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🟠 SurrealDB, Permissions Bypass Vulnerability, #CVE-2026-63733 (Medium) -DC-Sep2026-2204 https://dailycve.com/surrealdb-permissions-bypass-vulnerability-cve-2026-63733-medium-dc-sep2026-2204/
Post summary
The post announces a new SurrealDB permissions bypass vulnerability (CVE‑2026‑63733) listed on DailyCVE with medium severity, but it does not provide exploit details, POCs, active exploitation evidence, or patch information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | surrealdb | surrealdb | - | - | - |