Vulnerability · Published Jul 20, 2026 · Assigned by VulnCheck

CVE-2026-63752SurrealDB before 3.1.0 RELATE Statement Record Overwrite

Medium 4.3

In plain English

A medium-severity security flaw in surrealdb from surrealdb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.3%top 79.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SurrealDB before 3.1.0 contains an authorization bypass vulnerability in the RELATE statement that allows authenticated users with CREATE permission to overwrite existing edge records without UPDATE permission. Attackers can issue a RELATE statement with a SET id clause pointing to an existing edge id, causing the storage layer to silently overwrite the target record instead of rejecting the operation.

Affected products (as reported)

Vendor	Product	Versions
surrealdb	surrealdb	0 – before 3.1.0

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

GitHub Security Advisory (GHSA-f82j-v89j-mf86) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 RELATE Statement Record Overwrite third-party-advisory