Array element-level SELECT permission bypass in SurrealDB (CVE-2026-63740)

SurrealDB fails to correctly enforce element-level (`field.*`) SELECT permissions for record users. Instead of hiding denied array elements, the engine leaks a subset of them due to incorrect index handling during permission filtering - removing elements while iterating forward shifts subsequent indices, causing some denied elements to remain. An authenticated record user can read array data that element-level permissions should restrict on any table they can already SELECT. Affected versions: - <= 3.1.3 We recommend updating to: 3.1.4. CVSS 7.1 · our assessment: this_week Reference: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-8rw6-p7m8-63jp Details: https://vuln.today/cve/CVE-2026-63740