https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Sun, 20 Sep 2026 15:02:52 +0000 https://vulnerability.circl.lu/sighting/3923a6bf-dc48-424a-ac4c-d577e47255fc/export {"uuid": "3923a6bf-dc48-424a-ac4c-d577e47255fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-848m-r628-vrxw", "type": "seen", "source": "https://gist.github.com/alon710/c72bc251650f3404e8bd8c874dab4c7c", "content": "# CVE-2026-63735: CVE-2026-63735: Cross-Tenant Authorization Bypass in SurrealDB Custom API Routing Handler\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63735\n\n## Summary\nSurrealDB prior to version 3.2.0 is vulnerable to an authorization bypass where authenticated users can invoke custom API endpoints belonging to other tenants. This cross-tenant data access occurs because the system fails to validate authorization scope boundaries against request-supplied namespace and database identifiers before executing scripts with elevated definer's rights.\n\n## TL;DR\nAn authenticated SurrealDB user with minimal privileges can access and execute custom APIs defined by other tenants in multi-tenant environments, leading to unauthorized read/write access to arbitrary database resources.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639: Authorization Bypass Through User-Controlled Key\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.6 (High)\n- **EPSS Score**: 0.00367 (Percentile: 29.78%)\n- **Exploit Status**: PoC (Proof of Concept documented in integration tests)\n- **CISA KEV Status**: Not Listed\n- **Vulnerability Class**: Improper Authorization\n\n## Affected Systems\n\n- SurrealDB instances deployed in multi-tenant environments\n- SurrealDB versions prior to 3.2.0\n- **SurrealDB**: < 3.2.0 (Fixed in: `3.2.0`)\n\n## Mitigation\n\n- Upgrade the database engine to version 3.2.0 or later to ensure proper tenant boundary validation.\n- Manually implement identity verification using $auth context variables within custom API endpoints.\n- Use reverse proxies or API gateways to strip or block unauthorized URL paths targeting sensitive namespaces.\n\n**Remediation Steps:**\n1. Identify all deployed SurrealDB instances and run `surreal version` to check if they are below 3.2.0.\n2. Download and install the 3.2.0 or later package from official distribution repositories.\n3. Restart the SurrealDB services with the updated binaries.\n4. Verify the patch by attempting a cross-tenant API invocation using a test account to confirm the server returns a 403 Permission Denied error.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-848m-r628-vrxw)\n- [CNA Security Advisory (VulnCheck)](https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-custom-api)\n- [CVE Record Database Entry](https://www.cve.org/CVERecord?id=CVE-2026-63735)\n- [Wiz Vulnerability Analysis](https://www.wiz.io/vulnerability-database/cve/cve-2026-63735)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63735) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T12:32:19.150849Z"} {"uuid": "3923a6bf-dc48-424a-ac4c-d577e47255fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-848m-r628-vrxw", "type": "seen", "source": "https://gist.github.com/alon710/c72bc251650f3404e8bd8c874dab4c7c", "content": "# CVE-2026-63735: CVE-2026-63735: Cross-Tenant Authorization Bypass in SurrealDB Custom API Routing Handler\n\n> **CVSS Score:** 8.6\n> **Published:** 2026-09-04\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63735\n\n## Summary\nSurrealDB prior to version 3.2.0 is vulnerable to an authorization bypass where authenticated users can invoke custom API endpoints belonging to other tenants. This cross-tenant data access occurs because the system fails to validate authorization scope boundaries against request-supplied namespace and database identifiers before executing scripts with elevated definer's rights.\n\n## TL;DR\nAn authenticated SurrealDB user with minimal privileges can access and execute custom APIs defined by other tenants in multi-tenant environments, leading to unauthorized read/write access to arbitrary database resources.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-639: Authorization Bypass Through User-Controlled Key\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 8.6 (High)\n- **EPSS Score**: 0.00367 (Percentile: 29.78%)\n- **Exploit Status**: PoC (Proof of Concept documented in integration tests)\n- **CISA KEV Status**: Not Listed\n- **Vulnerability Class**: Improper Authorization\n\n## Affected Systems\n\n- SurrealDB instances deployed in multi-tenant environments\n- SurrealDB versions prior to 3.2.0\n- **SurrealDB**: < 3.2.0 (Fixed in: `3.2.0`)\n\n## Mitigation\n\n- Upgrade the database engine to version 3.2.0 or later to ensure proper tenant boundary validation.\n- Manually implement identity verification using $auth context variables within custom API endpoints.\n- Use reverse proxies or API gateways to strip or block unauthorized URL paths targeting sensitive namespaces.\n\n**Remediation Steps:**\n1. Identify all deployed SurrealDB instances and run `surreal version` to check if they are below 3.2.0.\n2. Download and install the 3.2.0 or later package from official distribution repositories.\n3. Restart the SurrealDB services with the updated binaries.\n4. Verify the patch by attempting a cross-tenant API invocation using a test account to confirm the server returns a 403 Permission Denied error.\n\n## References\n\n- [Official GitHub Security Advisory](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-848m-r628-vrxw)\n- [CNA Security Advisory (VulnCheck)](https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-custom-api)\n- [CVE Record Database Entry](https://www.cve.org/CVERecord?id=CVE-2026-63735)\n- [Wiz Vulnerability Analysis](https://www.wiz.io/vulnerability-database/cve/cve-2026-63735)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63735) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-05T12:32:19.150849Z"} https://vulnerability.circl.lu/sighting/3923a6bf-dc48-424a-ac4c-d577e47255fc/export Sat, 05 Sep 2026 12:32:19 +0000