CVE-2026-121418Medium· 4.3▾ SunlitSurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attac…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors.
surrealdb >= 3.1.0 < 3.3.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109336Medium· 4.3SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections
CVE-2026-63751Medium· 4.3SurrealDB before 3.1.0 Field Permission Bypass via JSON Patch
CVE-2026-63755Medium· 6.5SurrealDB before 3.1.0 Permission Bypass via WHERE Clause
GHSA-8rw6-p7m8-63jpMedium· 6.5SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
CVE-2025-71390High· 8.8SurrealDB before 2.2.6, 2.3.6, and 2.1.8 (and 3.0.0-alpha.7 and earlier) fails to validate DNS-resolved hostnames against --deny-net network access restrictions in its http::* functions
GHSA-fpxg-5xmv-922mMedium· 4.3SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`