EUVD-2026-45911
GHSA-j6mj-v752-pp4x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable query interface (AV:N/AC:L), requires a valid record-scope login so PR:L, no user interaction; confidentiality-only disclosure of denied data with no integrity or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrect index handling during permission filtering.
AnalysisAI
Broken authorization in SurrealDB before 3.1.4 allows record-scoped (authenticated) users to read array elements that field-level SELECT permissions are supposed to hide. When permissions are evaluated against array fields using the field.* wildcard, denied elements are leaked back to the caller instead of being filtered out, because the engine mishandles element indexing during permission filtering (CWE-863). No public exploit has been identified at time of analysis and it is not in CISA KEV, but the flaw is a straightforward authorization bypass reachable by any user with record scope access.
Technical ContextAI
SurrealDB is a multi-model (document/graph/relational) database that enforces row- and field-level access control through record users ("record scope" authentication) and permission clauses defined in the schema. This vulnerability lives in the permission-filtering logic that post-processes SELECT results: for array-valued fields addressed with the field.* wildcard, the engine is meant to strip individual elements the caller is not permitted to see. Due to incorrect index handling while iterating and filtering the array, elements that should be removed remain in the response. This is a classic CWE-863 Incorrect Authorization defect - the permission decision is computed but applied to the wrong positions, so denied data is disclosed rather than withheld.
RemediationAI
Upgrade to SurrealDB 3.1.4 or later, which contains the corrected array-element permission filtering - Vendor-released patch: 3.1.4. If immediate upgrade is not possible, reduce exposure by avoiding element-level (field.*) SELECT permissions as the sole control for sensitive array data: restructure sensitive elements into separate records or fields protected by whole-field permissions, or move sensitive values out of arrays entirely so record/table-level permissions apply cleanly. Additionally, tighten who can obtain record-scope credentials and audit existing record users, since exploitation requires an authenticated record account. Track the fix and details via the vendor advisory https://github.com/surrealdb/surrealdb/security/advisories/GHSA-8rw6-p7m8-63jp and https://www.vulncheck.com/advisories/surrealdb-before-array-element-permission-bypass. Trade-off: restructuring schema to avoid field.* reliance can require query and application changes, so the upgrade to 3.1.4 remains the clean fix.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today