SurrealDB CVE-2026-109341

Exploitation requires an authenticated caller who already holds table-level WRITE permission on the target table but is restricted from SELECTing specific fields (PR:L) - this is the exact precondition named in the advisory. The flaw is triggered specifically through SurrealDB's JSON Patch support: 'copy' or 'move' operations whose pointers resolve against the unreduced (pre-permission-filtered) record, or 'test' operations whose mismatch errors act as a disclosure oracle. It is therefore only meaningful in deployments that rely on field-level SELECT restrictions as a security boundary while granting record-write access (e.g. multi-tenant or least-privilege role setups) on SurrealDB versions before 3.3.0. It does NOT apply to pre-authentication attackers or to deployments without field-level permission separation, and no user interaction is required (UI:N).

This is a credible but moderate-priority vulnerability rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N, 7.1 High) is internally consistent with the description: a network-reachable, low-complexity attack that requires PR:L - i.e. an already-authenticated caller holding table-level write permission - to achieve high confidentiality impact by reading SELECT-restricted fields. The primary signal is confidentiality disclosure; integrity impact is low (VI:L) because PATCH copy/move only moves already-existing hidden data into a readable field, and availability is unaffected (VA:N). Crucially, there is NO CISA KEV listing, NO public POC in the provided data, and NO EPSS score supplied, so there is no evidence of active or probable near-term exploitation - the urgency rests on a disclosed advisory, not observed attacks. SSVC-style framing: exploitation is 'none observed,' technical impact is 'partial' (data read, not full control), and automatability is limited because the attacker must first possess valid write credentials on the target table. The key limiting factor that tempers the High score is the PR:L precondition - this is not a pre-auth bypass but a privilege-boundary violation within an already-trusted session, making it most relevant in multi-tenant deployments or where write-but-not-read field permissions are a deliberate security control.

An attacker who already holds table-level write permission in a multi-tenant SurrealDB instance crafts a JSON Patch request using a 'copy' or 'move' operation whose source pointer targets a field they are forbidden to SELECT (e.g. a password hash or PII column), copying it into a destination field they can read back. Alternatively they submit PATCH 'test' operations and observe success/mismatch error responses to brute-force hidden values as a disclosure oracle. No public exploit code is identified at time of analysis, but exploitation is low-complexity (AC:L) and requires only an authenticated low-privilege account.