VULNERABILITY INTELLIGENCE

CVE-2026-63742

CVSS score5.3 MEDIUM
EPSS probability0.29%
CISA KEVNot currently listed
Published2026-07-20
Last modified2026-07-22
CVSS vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Description

SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries on indexed fields with field-level SELECT restrictions to confirm or recover restricted field values through repeated guesses.

Weakness classification

  • CWE-863: Incorrect Authorization

Primary references