CVE-2026-63763

Estado: AnalizadaAlta (7.5)—

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database editor role) can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the invoking/querying user rather than their creator, an attacker can plant malicious logic that executes with a higher-privileged user's permissions when that user reads or writes the affected record. This can lead to full privilege escalation, including creation of a root owner and server takeover.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 7.5

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.50%
Percentil entre todas las CVEs puntuadas: 41
Fecha de la puntuación: 6/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1203 Exploitation for Client Executionexecution75 %
Impacto principalT1068 Exploitation for Privilege Escalationprivilege escalation85 %
Impacto secundarioT1078 Valid Accountsstealth · persistence · privilege escalation · initial access80 %
Impacto secundarioT1098 Account Manipulationpersistence · privilege escalation75 %

Requiere interacción del usuario (UI:P) para que un usuario privilegiado lea/escriba el registro malicioso (T1203). Escala privilegios mediante ejecución con permisos elevados (T1068), crea cuentas root (T1098) y obtiene acceso como admin (T1078).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User Account Management Privileged Account Management Multi-factor Authentication Application Isolation and Sandboxing Exploit Protection Update Software

Tecnologías afectadas (1)

Surrealdb — Surrealdb

CWE

CWE-639

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-63763",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-63763",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-07-20T15:44:33.534497Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 7.5,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "surrealdb",
          "product": "surrealdb",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.5.0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "2.5.0",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:cargo/surrealdb",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "surrealdb",
          "product": "surrealdb",
          "versions": [
            {
              "status": "affected",
              "version": "3.0.0-alpha.1",
              "lessThan": "3.0.0-beta.3",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "3.0.0-beta.3",
              "versionType": "semver"
            }
          ],
          "packageURL": "pkg:cargo/surrealdb",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-07-20T12:19:46.623",
  "references": [
    {
      "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3v2x-9xcv-2v2v",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/surrealdb-before-privilege-escalation-via-future-fields",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-639"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database editor role) can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the invoking/querying user rather than their creator, an attacker can plant malicious logic that executes with a higher-privileged user's permissions when that user reads or writes the affected record. This can lead to full privilege escalation, including creation of a root owner and server takeover."
    }
  ],
  "lastModified": "2026-07-22T19:40:00.720",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "981D26FA-F1A9-4A13-ACFC-C0964FE2C1A2",
              "versionEndExcluding": "2.5.0"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "83C6C6C1-EEC9-439D-AC9D-C0693BFF5E1D"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha10:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3860DB8A-97D5-424B-B1AE-81744820288C"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha11:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A14ADE8-2ED8-4FC1-88A5-0B10F4AA433A"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha12:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FE814CC4-38DB-4DB3-9A01-D4A0E04A1D5F"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha13:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ECB711FC-3F98-4FB7-8C1E-251F6596A542"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha14:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A3B9151B-92C0-43C7-A9B3-C0259F8190E8"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha16:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "021C19BF-6F23-44F9-B4EF-D666C7489A16"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha17:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D35718FE-7E51-4A5A-8DA5-FB6B9C86853A"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha18:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2225B4F4-3EC0-493C-B9ED-CED81C0C01D1"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71C5581F-1FEA-4DA3-9130-C2E75DDF71F1"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3F9C2A9-699D-4C82-B215-837513CC2760"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "16E5D9C2-AAA5-4BC1-9BA8-C827336B0CAC"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "280BECEF-32D8-4A57-A083-FD70CAEB98A8"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha6:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A589A4EF-EF41-4527-A3C8-68420E361F3D"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha7:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1736B735-8761-4E2F-95D9-D9ACA4789676"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha8:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "871B8B8F-83B0-49A9-848B-D15D5D4B4B05"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:alpha9:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F07CDC5E-E692-4C56-95C1-140255860858"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:beta1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DB76E7FF-77B1-43E1-A77B-49871C96D202"
            },
            {
              "criteria": "cpe:2.3:a:surrealdb:surrealdb:3.0.0:beta2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D69592F-488E-4373-B03C-1D44B646AB2C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com"
}