{"action":"Upgrade surrealdb to 3.1.0 or later.","affected":[{"fixed":"3.1.0","introduced":"0"}],"component":"surrealdb","cve_ids":["CVE-2026-63751"],"ecosystem":"crates.io","epss":0.00293,"exploited":false,"fixed_versions":["3.1.0"],"ghsa_id":"GHSA-fpxg-5xmv-922m","id":"tcs_01M5KEXK16YES2N90QS90YAP08","modified_at":"2026-09-04T20:25:35.639474Z","published_at":"2026-07-01T20:18:06Z","references":["https://osv.dev/vulnerability/GHSA-fpxg-5xmv-922m","https://github.com/surrealdb/surrealdb/security/advisories/GHSA-fpxg-5xmv-922m","https://nvd.nist.gov/vuln/detail/CVE-2026-63751","https://github.com/surrealdb/surrealdb/commit/56a7a1540d9228f82fd6284c258344e8dcb690fd","https://github.com/surrealdb/surrealdb","https://www.vulncheck.com/advisories/surrealdb-before-field-permission-bypass-via-json-patch"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-fpxg-5xmv-922m","url":"https://osv.dev/vulnerability/GHSA-fpxg-5xmv-922m"}],"summary":"SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`"}