SurrealDB CVE-2026-121418

Requires a valid authenticated SurrealDB record user holding table-level SELECT permission (PR:L), targeting a database whose schema defines a field-level restrictive (non-FULL) SELECT permission on a field AND an index covering that restricted field - specifically a FULLTEXT index (queried via @@/MATCHES), a compound B-tree index (queried with the restricted-field predicate plus a residual unrestricted-field predicate), or an HNSW vector index (queried via KNN <|k,ef|>). The vulnerable path is the streaming execution planner, which is the default for supported read-only statements in versions 3.1.0 up to (not including) 3.3.0. Limiting factors that reduce real-world exposure: the attacker must already have authenticated record-user access (no anonymous/remote-unauthenticated path); the deployment must actually use restrictive field-level SELECT permissions together with indexes on those restricted fields; a simple single-field restricted B-tree equality is NOT affected because that form retains the original predicate for re-evaluation (negative control); and disclosure is inferential (result-set membership/proximity oracle) rather than direct retrieval of the restricted value.

This is a medium-severity information-disclosure flaw, not a high-impact break: the CVE-record CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N) scores 5.3, and the GHSA's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) agrees - network-reachable, low complexity, but requires an authenticated principal (PR:L) and yields only a low, confidentiality-only impact (VI/VA and I/A are N). The key risk-moderating signal is mechanism: the attacker is already a legitimate record user with table-level SELECT, and the flaw merely lets them use restricted-field indexes as a confirmation/proximity oracle (inferring which record IDs contain a guessed value, term, or nearest vector) rather than reading the restricted field directly - hence C:L rather than C:H. The vuln.today Decision label is 'this_month' (not act_now/emergency), consistent with a real-but-not-urgent issue. No CISA KEV listing and no EPSS score were supplied, so there is no evidence of active or probable widespread exploitation; however, a complete, recorded proof-of-concept is published in the GHSA advisory, so exploitability is demonstrated, not theoretical. Net: a genuine authorization-boundary defect worth patching on a normal cycle, but its blast radius is gated by authenticated access plus a specific schema configuration, so it is not a drop-everything internet-wide threat. One data conflict to verify: the advisory prose says 'No fixed version is available' and was confirmed on 3.3.0-nightly, while the structured package metadata and CVE title state the fix is in 3.3.0 - confirm the exact fixed build with the vendor.

A multi-tenant application backs its data on SurrealDB and grants end users record-user access with field-level SELECT permissions that hide sensitive columns (e.g. password hints, secret tokens, or embeddings). An authenticated record user issues full-text MATCHES, compound B-tree, or HNSW KNN queries against those restricted fields and reads the returned record-ID membership to confirm guessed values or nearest vectors, even though direct SELECT still hides the field. A complete working PoC with recorded results is published in the GHSA advisory.