EUVD-2026-45909
GHSA-9c3h-q3pp-fw5x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via standard query interface, low complexity; PR:L because an authenticated record session is required; C:L for bounded field-value disclosure within already-authorized tables only.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph traversals instead of direct table scans.
AnalysisAI
Field-level SELECT permission bypass in SurrealDB 3.1.0-3.1.4 allows authenticated record users to recover field values explicitly hidden by DEFINE FIELD ... PERMISSIONS FOR select NONE by routing queries through graph-edge (->) or back-reference (<~) traversals rather than direct table scans. The shared resolve_record_batch helper used by the 3.1.x query planner's GraphEdgeScan and ReferenceScan paths enforces only table-level authorization, silently skipping the build_field_state/filter_fields_by_permission routines applied on all other read paths. No public exploit has been identified at time of analysis; vendor-released patch is available in version 3.1.5.
Technical ContextAI
SurrealDB is a multi-model database written in Rust supporting graph traversal query syntax. The 3.1.0 release introduced new scan strategies - GraphEdgeScan (full-edge -> traversals) and ReferenceScan (back-reference <~ traversals) - both backed by a shared helper, resolve_record_batch. This helper materializes full record objects and correctly applies table-level SELECT enforcement (a fix introduced in 3.1.0 for GHSA-vjjx-rfw4-rmfc), but it never invokes the field-level filtering routines (build_field_state / filter_fields_by_permission) that ordinary table scans and the fetch_record path apply. The result is an inconsistent authorization boundary: the same record returned safely by SELECT * FROM knows exposes hidden fields when reached via person:bob->(SELECT * FROM knows). CWE-863 (Incorrect Authorization) precisely captures the root cause - authorization logic that is correct in one code path is absent in a functionally equivalent alternate path. The affected package is the Rust crate surrealdb, versions >= 3.1.0 and < 3.1.5.
RemediationAI
The primary remediation is to upgrade SurrealDB to version 3.1.5 or later, which patches resolve_record_batch to apply field-level SELECT permissions and evaluate COMPUTED fields consistently for all graph-edge and back-reference traversal results, matching the behavior of regular table scans and fetch_record. The vendor advisory at https://github.com/surrealdb/surrealdb/security/advisories/GHSA-hv6h-hc26-q48p confirms 3.1.5 as the fixed release. If an immediate upgrade is not possible, the vendor documents a workaround: start SurrealDB with the --planner-strategy compute-only flag or set the environment variable SURREAL_PLANNER_STRATEGY=compute-only to force the legacy executor that does not use the affected GraphEdgeScan/ReferenceScan paths. The trade-off is that compute-only planning disables the newer query optimization strategies introduced in 3.1.x, which may increase query latency for graph-heavy workloads. A second partial mitigation is to audit DEFINE FIELD permission definitions and ensure that sensitive fields requiring strict access control are not on tables that record users can reach via graph traversals - however, this requires schema redesign and does not address the underlying authorization gap.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today