Is CVE-2026-63735 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-63735?

CVE-2026-63735 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-63735

Description

SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing authenticated users to invoke endpoints in different namespaces/databases. Attackers with valid credentials for any namespace/database can access custom API endpoints in other tenants by specifying the target scope in the URL path, reading sensitive data or triggering unintended operations.