CVE-2026-63748CWE-209

SurrealDB before 3.1.0 Information Disclosure via Error Messages

Medium · published July 20, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
24.5
In the wild
Unconfirmed
What it is

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw operand values in error responses, bypassing field-level access controls.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00326 · 24.5th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2026-07-20T12:04Z
EPSS history
Timeline
  • 20 JUL 12:04Z
    SurrealDB before 3.1.0 Information Disclosure via Error Messages
    cvelistv5