HIGH 8.1 GitHub
CVE-2026-63735
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path
An authenticated user scoped to one namespace/database could invoke a custom API (`DEFINE API`) belonging to a different namespace/database, reaching another tenant's endpoint.
The route `/api/{namespace}/{database}/{endpoint}` took the namespace and database from the URL and applied them to the caller's session before the endpoint was looked up or run, without checking that the caller's authenticated scope covered them. Because a custom API handler runs with permissions disabled (definer's rig
Affected Products
- rust/surrealdb < 3.2.0
References
- https://github.com/advisories/GHSA-848m-r628-vrxw
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-848m-r628-vrxw
- https://nvd.nist.gov/vuln/detail/CVE-2026-63735
- https://github.com/surrealdb/surrealdb/commit/0938f88d196dc4eb11a82af343df3fffe9c195e2
This high severity vulnerability with a CVSS score of 8.1 was published on 2026-09-04 via GitHub. Affected: rust/surrealdb < 3.2.0.
vulnfeed aggregates 10236 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.