CVE-2026-63752CWE-285

SurrealDB before 3.1.0 RELATE Statement Record Overwrite

Medium · published July 20, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite the target record instead of rejecting the operation.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00280 · 19.4th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-07-20T12:04Z
EPSS history
Timeline
  • 20 JUL 12:04Z
    SurrealDB before 3.1.0 RELATE Statement Record Overwrite
    cvelistv5