{"id":"CVE-2026-121418","title":"SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner","summary":"SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attac…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-863"],"vendor":"surrealdb","product":"surrealdb","affected":["surrealdb >= 3.1.0 < 3.3.0"],"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T14:28:15.918Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121418","references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x6mm-9295-rvph","label":"GitHub Security Advisory (GHSA-x6mm-9295-rvph)"},{"url":"https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-incorrect-authorization-via-streaming-index-planner","label":"VulnCheck Advisory: SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner"}],"tags":["cve.org"],"epss":0.00204,"epssPercentile":0.10516,"ingestedAt":"2026-11-05T19:30:42.966Z","slug":"CVE-2026-121418","body":"## Overview\n\nSurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors.\n\n## Affected\n\n- `surrealdb >= 3.1.0 < 3.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}