Is CVE-2026-63742 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-63742?

CVE-2026-63742 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-63742

Description

SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries on indexed fields with field-level SELECT restrictions to confirm or recover restricted field values through repeated guesses.