Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by specifying the target scope in the URL path, reading sensitive data or triggering unintended operations.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 SurrealDB, Authorization Bypass Through User-Controlled Key, #CVE-2026-63735 (High) -DC-Sep2026-2211 https://dailycve.com/surrealdb-authorization-bypass-through-user-controlled-key-cve-2026-63735-high-dc-sep2026-2211/
Post summary
The text announces SurrealDB’s new high‑severity vulnerability CVE‑2026‑63735, describing an authorization bypass via user‑controlled key, without any mention of exploits, PoCs, or patches.
URLs as master keys? SurrealDB’s custom routes let any authenticated user jump tenants just by tweaking the path. Classic scope check missing where it mattered. https://ekofyi.com/blog/cve-2026-63735-surrealdb-cross-tenant-bypass
Post summary
The blog highlights a cross‑tenant bypass flaw (CVE‑2026‑63735) in SurrealDB that lets authenticated users alter URLs to access tenants they shouldn’t, due to missing scope checks.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | surrealdb | surrealdb | - | - | - |