Vulnerability-Lookup

GHSA-848M-R628-VRXW

Vulnerability from github – Published: 2026-09-04 20:07 – Updated: 2026-09-04 20:07

Summary

SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path

Details

An authenticated user scoped to one namespace/database could invoke a custom API (DEFINE API) belonging to a different namespace/database, reaching another tenant's endpoint.

The route /api/{namespace}/{database}/{endpoint} took the namespace and database from the URL and applied them to the caller's session before the endpoint was looked up or run, without checking that the caller's authenticated scope covered them. Because a custom API handler runs with permissions disabled (definer's rights), the endpoint's own PERMISSIONS clause was the only gate — open to everyone for a PERMISSIONS FULL endpoint. The api::invoke() function was affected the same way, resolving against the session's selected namespace/database (settable via the surreal-ns / surreal-db headers or USE).

Impact

What an attacker can do:

With valid credentials for any one namespace/database (a VIEWER is enough), invoke a custom API in another namespace/database by naming the victim scope in the URL.
Read data that endpoint returns — including from PERMISSIONS NONE tables, since the handler runs with permissions disabled — or trigger any writes and side effects it performs.

What it can't do:

Reach a scope without valid credentials for some namespace/database on the instance; this is not an unauthenticated bypass.
Affect single-tenant deployments, or any deployment where callers already hold instance-wide (root) scope.

Patches

The namespace/database is now validated against the caller's authenticated level — which the request cannot change — before the endpoint is resolved or run. A target scope outside that level is rejected with 403 Forbidden, both at the HTTP entry point and at the dispatch step shared with api::invoke(). Root reaches any scope; namespace principals their namespace; database and record principals their exact namespace/database; anonymous callers remain governed by the endpoint's PERMISSIONS.

Versions 3.2.0 and later are not affected by this issue.

Workarounds

Users unable to patch should consider the following workarounds:

Disable the custom API HTTP route via capabilities where it is not required.
Treat separate deployments, not namespace/database boundaries, as the tenant isolation boundary on shared instances.
Prefer a PERMISSIONS WHERE clause that checks the authenticated identity over PERMISSIONS FULL (reduces exposure but does not restore the boundary).

Resources

SurrealQL Documentation — DEFINE API
SurrealDB Documentation — Capabilities
fix(core/api): reject cross-tenant custom API access (included in SurrealDB 3.2.0)

Acknowledgements

SurrealDB thanks sondt99 for reporting this issue.

Severity

8.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "surrealdb"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63735"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-04T20:07:07Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "An authenticated user scoped to one namespace/database could invoke a custom API (`DEFINE API`) belonging to a different namespace/database, reaching another tenant\u0027s endpoint.\n\nThe route `/api/{namespace}/{database}/{endpoint}` took the namespace and database from the URL and applied them to the caller\u0027s session before the endpoint was looked up or run, without checking that the caller\u0027s authenticated scope covered them. Because a custom API handler runs with permissions disabled (definer\u0027s rights), the endpoint\u0027s own `PERMISSIONS` clause was the only gate \u2014 open to everyone for a `PERMISSIONS FULL` endpoint. The `api::invoke()` function was affected the same way, resolving against the session\u0027s selected namespace/database (settable via the `surreal-ns` / `surreal-db` headers or `USE`).\n\n### Impact\n\nWhat an attacker **can** do:\n\n- With valid credentials for any one namespace/database (a `VIEWER` is enough), invoke a custom API in another namespace/database by naming the victim scope in the URL.\n- Read data that endpoint returns \u2014 including from `PERMISSIONS NONE` tables, since the handler runs with permissions disabled \u2014 or trigger any writes and side effects it performs.\n\nWhat it **can\u0027t** do:\n\n- Reach a scope without valid credentials for some namespace/database on the instance; this is not an unauthenticated bypass.\n- Affect single-tenant deployments, or any deployment where callers already hold instance-wide (root) scope.\n\n### Patches\n\nThe namespace/database is now validated against the caller\u0027s authenticated level \u2014 which the request cannot change \u2014 before the endpoint is resolved or run. A target scope outside that level is rejected with `403 Forbidden`, both at the HTTP entry point and at the dispatch step shared with `api::invoke()`. Root reaches any scope; namespace principals their namespace; database and record principals their exact namespace/database; anonymous callers remain governed by the endpoint\u0027s `PERMISSIONS`.\n\n- Versions 3.2.0 and later are not affected by this issue.\n\n### Workarounds\n\nUsers unable to patch should consider the following workarounds:\n\n- Disable the custom API HTTP route via capabilities where it is not required.\n- Treat separate deployments, not namespace/database boundaries, as the tenant isolation boundary on shared instances.\n- Prefer a `PERMISSIONS WHERE` clause that checks the authenticated identity over `PERMISSIONS FULL` (reduces exposure but does not restore the boundary).\n\n### Resources\n\n- [SurrealQL Documentation \u2014 DEFINE API](https://surrealdb.com/docs/surrealql/statements/define/api)\n- [SurrealDB Documentation \u2014 Capabilities](https://surrealdb.com/docs/surrealdb/security/capabilities)\n- `fix(core/api): reject cross-tenant custom API access` (included in SurrealDB 3.2.0)\n\n### Acknowledgements\n\nSurrealDB thanks [sondt99](https://github.com/sondt99) for reporting this issue.",
  "id": "GHSA-848m-r628-vrxw",
  "modified": "2026-09-04T20:07:07Z",
  "published": "2026-09-04T20:07:07Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-848m-r628-vrxw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63735"
    },
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/commit/0938f88d196dc4eb11a82af343df3fffe9c195e2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/surrealdb/surrealdb/commit/75b7154f84904d047619b5a47b08d256254dceca"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/surrealdb/surrealdb"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-custom-api"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path"
}

CVE-2026-63735 (GCVE-0-2026-63735)

Vulnerability from cvelistv5 – Published: 2026-07-20 12:04 – Updated: 2026-07-28 01:05

Title

SurrealDB before 3.2.0 Authentication Bypass via Custom API

Summary

SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by specifying the target scope in the URL path, reading sensitive data or triggering unintended operations.

Severity

8.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-23 19:07 UTC

CWE

CWE-639 - Authorization Bypass Through User-Controlled Key

Assigner

VulnCheck mitre root

References

2 references

URL	Tags
https://github.com/surrealdb/surrealdb/security/a…	vendor-advisory
https://www.vulncheck.com/advisories/surrealdb-be…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
surrealdb	surrealdb	Affected: 0 , < 3.2.0 (semver) Unaffected: 3.2.0 (semver) cpe:2.3:a:surrealdb:surrealdb::::::::

Date Public

2026-07-02 00:00

Credits

sondt99

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-63735",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-23T19:07:11.111007Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-23T19:07:19.501Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:cargo/surrealdb",
          "product": "surrealdb",
          "vendor": "surrealdb",
          "versions": [
            {
              "lessThan": "3.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.2.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "sondt99"
        }
      ],
      "datePublic": "2026-07-02T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by specifying the target scope in the URL path, reading sensitive data or triggering unintended operations."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T01:05:33.142Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Security Advisory (GHSA-848m-r628-vrxw)",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-848m-r628-vrxw"
        },
        {
          "name": "VulnCheck Advisory: SurrealDB before 3.2.0 Authentication Bypass via Custom API",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-custom-api"
        }
      ],
      "title": "SurrealDB before 3.2.0 Authentication Bypass via Custom API",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-63735",
    "datePublished": "2026-07-20T12:04:31.479Z",
    "dateReserved": "2026-07-18T12:19:06.903Z",
    "dateUpdated": "2026-07-28T01:05:33.142Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.