Skip to content
Threat Feed
Subscribe

Product

SurrealDB (Before 3.2.0)

1 brief RSS
high advisory

CVE-2026-63735: SurrealDB Scope Validation Bypass in Custom API Routes

A vulnerability, CVE-2026-63735, in SurrealDB versions prior to 3.2.0 allows authenticated users to bypass namespace and database scope validation in custom API routes by manipulating the URL path, potentially leading to unauthorized data reading or triggering unintended operations across different tenants.

SurrealDB vulnerability database api-bypass data-exfiltration privilege-escalation
2t 1c 2i