Answer in brief
CVE-2026-63748 records a Medium severity (CVSS 4.3) vulnerability in SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages. The current sources do not mark it as known exploited. The current feed maps surrealdb (rust). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 4.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps surrealdb (rust). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| surrealdbrust | <3.1.0 | 3.1.0 |
Published upstream
Jul 1, 2026
Evidence: source:ghsa:source_dates:source-dates:recordSource modified
Sep 4, 2026
Evidence: source:ghsa:source_dates:source-dates:recordFirst seen by HOL
Jul 1, 2026
A record user with UPDATE access could read field values that field-level SELECT permissions hid from them. Arithmetic operators and `extend` embedded the raw operand into their error messages, and UPDATE permission checks evaluate against the unreduced document — so triggering such an error against a hidden field returned its value in the resulting error. ### Impact A record user issues an UPDATE that performs an incompatible operation against a hidden field — e.g. `UPDATE person:me SET probe = email + 1` when `email` is a string — and reads the value from the returned error (`Tried to compute "[email protected]" + 1 …`). One field per operation, but the attacker can repeat against any field on any record they can UPDATE. ### Patches A patch has been introduced that replaces the raw operand in every `try_*` operator and in `extend` with the operand's type name (`"string"`, `"int"`, `"array"`, etc.). - Versions 3.1.0 and later are not affected by this issue. ### Workarounds Affected users who are unable to update should not grant UPDATE permission on records whose field-level SELECT permissions are expected to hide values from the same caller.
Quoted source text, attributed separately from HOL analysis.