Api-Bypass - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/api-bypass/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 20 Jul 2026 12:24:58 +0000CVE-2026-63735: SurrealDB Scope Validation Bypass in Custom API Routeshttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-63735-surrealdb-scope-bypass/Mon, 20 Jul 2026 12:24:58 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-cve-2026-63735-surrealdb-scope-bypass/A vulnerability, CVE-2026-63735, in SurrealDB versions prior to 3.2.0 allows authenticated users to bypass namespace and database scope validation in custom API routes by manipulating the URL path, potentially leading to unauthorized data reading or triggering unintended operations across different tenants.CVE-2026-63735 describes a critical vulnerability in SurrealDB versions released before 3.2.0, where the database system fails to properly validate namespace and database scopes within custom API routes. This flaw permits authenticated users who possess valid credentials for any namespace or database to access and invoke custom API endpoints belonging to other tenants. By crafting specific URL paths to target different scopes, attackers can exploit this vulnerability to read sensitive data from unauthorized namespaces or databases, or to trigger operations not intended for their authenticated context. This issue has a CVSS v3.1 Base Score of 8.1, indicating a high severity due to the potential for unauthorized access to data and system manipulation, impacting multi-tenant SurrealDB deployments.

Attack Chain

  1. An attacker obtains valid authentication credentials for any namespace or database within a SurrealDB instance.
  2. The attacker identifies a custom API route within the SurrealDB application.
  3. The attacker crafts an HTTP request to target the identified custom API route.
  4. Within the URL path of the request, the attacker specifies a namespace or database scope that is different from their legitimately authenticated scope.
  5. Due to the vulnerability (CVE-2026-63735), the SurrealDB instance processes the request without adequately validating that the authenticated user's session context matches the targeted namespace/database in the URL path.
  6. The custom API endpoint is executed within the context of the unauthorized, targeted namespace or database.
  7. This exploitation allows the attacker to read sensitive data from the unauthorized tenant or trigger unintended operations, achieving their objective.

Impact

Successful exploitation of CVE-2026-63735 can lead to significant data breaches and unauthorized system manipulation in multi-tenant SurrealDB environments. Attackers gaining access to one namespace or database can leverage this vulnerability to traverse across other tenants, reading sensitive data such as user records, financial information, or proprietary business data. Furthermore, the ability to trigger "unintended operations" implies potential for data modification, service disruption, or even the creation of persistence mechanisms within other tenants, leading to widespread compromise and operational disruption. The vulnerability affects the confidentiality, integrity, and potentially availability of data across all tenants on a vulnerable SurrealDB instance.

Recommendation

  • Patch CVE-2026-63735 by upgrading all SurrealDB instances to version 3.2.0 or later immediately.
  • Implement robust logging for web server access and application-specific API calls to identify unusual access patterns involving different namespace or database identifiers in URL paths.
  • Monitor for HTTP requests targeting SurrealDB custom API routes that contain path elements referencing namespaces or databases outside of the authenticated user's known scope.
]]>highadvisoryvulnerabilitydatabaseapi-bypassdata-exfiltrationprivilege-escalation