Cyber Resilience

CVE-2026-63748

Info Disclosure in Surrealdb ≤ 3.1.0

Public PoCInfo Disclosure
Published
20 July 2026
Modified
22 July 2026
Patch / advisory
CVSS Score v4 5.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0019 9th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-63748 is a medium-severity Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability in Surrealdb Surrealdb. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Databases (T1213.006); ranked at the 9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw…

more

operand values in error responses, bypassing field-level access controls.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1213.006 Databases Collection
Adversaries may leverage databases to mine valuable information.
Why these techniques?

Vulnerability directly bypasses DB field permissions to disclose hidden values, enabling unauthorized data collection from databases.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-63740Same product: Surrealdb Surrealdb
CVE-2026-63751Same product: Surrealdb Surrealdb
CVE-2026-63746Same product: Surrealdb Surrealdb
CVE-2026-63749Same product: Surrealdb Surrealdb
CVE-2026-63738Same product: Surrealdb Surrealdb
CVE-2026-63742Same product: Surrealdb Surrealdb
CVE-2026-63755Same product: Surrealdb Surrealdb
CVE-2026-63735Same product: Surrealdb Surrealdb
CVE-2026-63733Same product: Surrealdb Surrealdb
CVE-2026-63763Same product: Surrealdb Surrealdb

Affected Assets

surrealdb
surrealdb
≤ 3.1.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V16.5.1

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-209

Detects error messages that leak sensitive information as evidence of disclosure.

addresses: CWE-209

The control directly mitigates generation of error messages containing sensitive authentication details by requiring obscured feedback instead of verbose responses.

addresses: CWE-209

Misdirection allows generation of misleading error messages that withhold or falsify sensitive details.

addresses: CWE-209

Explicitly requires error messages to avoid including sensitive or exploitable details while still supporting corrective action.

addresses: CWE-209

Validation ensures error messages contain only expected, non-sensitive content and blocks leakage via verbose errors.

addresses: CWE-209

Fail-safe procedures can be defined to suppress or sanitize error output, reducing generation of messages that contain sensitive information.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require sanitized error handling to prevent sensitive data disclosure.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Secure coding standards explicitly forbid exposing sensitive data in errors.

detects

Security testing can detect error messages that leak sensitive information.

A.8.15 Logging partial match
degrades

Logging policy can require suppression of sensitive data in error messages.

prevents

Secure SDLC mandates error-handling rules that avoid leaking sensitive information.

prevents

Application security requirements can specify safe error messaging.

prevents

Secure architecture principles include proper exception handling.

References