EUVD-2026-45922
GHSA-8pr5-wpg9-2h74
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible but requires low-privilege authentication; confidentiality limited to single-record field exposure with no integrity, availability, or scope impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB versions before 3.1.0 contain a field-level permission bypass vulnerability in JSON Patch operations that allows authenticated users to read protected fields. Attackers can use UPDATE PATCH with an empty from pointer in copy or move operations to duplicate all record fields, including those restricted by field-level SELECT permissions, into attacker-chosen destination fields.
AnalysisAI
Field-level SELECT permission bypass in SurrealDB before 3.1.0 allows authenticated users to exfiltrate protected field values via a crafted JSON Patch operation. Submitting an UPDATE PATCH with an empty string as the from pointer in a copy or move operation causes the database to duplicate the entire record - including fields restricted by PERMISSIONS FOR select - into an attacker-controlled destination field that bypasses the post-query redaction filter. Impact is confidentiality-only and bounded to fields of the single targeted record; no KEV listing and no public exploit code identified at time of analysis, though exploitation requires only a valid authenticated session and standard JSON Patch syntax.
Technical ContextAI
SurrealDB is a multi-model database written in Rust that implements JSON Patch (RFC 6902) via its UPDATE … PATCH statement and SDK equivalents such as db.patch(). RFC 6902 copy and move operations use a JSON Pointer from field to designate the source. CWE-863 (Incorrect Authorization) applies: when from is the empty string, SurrealDB incorrectly treated it as a reference to the entire record object rather than rejecting it as an invalid pointer. The resulting copy operation propagated all record fields - including those protected by field-level PERMISSIONS FOR select clauses - into the caller-specified path destination. The post-processing permission filter that strips protected fields from responses only operated on canonical field names and had no visibility into the newly created destination fields, so protected values were returned verbatim. The fix introduced in 3.1.0 (commit 56a7a1540d9228f82fd6284c258344e8dcb690fd) rejects empty from pointers at parse time for both copy and move operations. Affected package: rust/surrealdb < 3.1.0 per GHSA-fpxg-5xmv-922m.
RemediationAI
Upgrade to SurrealDB 3.1.0 or later, which rejects empty from pointers in JSON Patch copy and move operations at parse time; the upstream fix is committed at https://github.com/surrealdb/surrealdb/commit/56a7a1540d9228f82fd6284c258344e8dcb690fd. For deployments that cannot immediately upgrade, two workarounds are available per the vendor advisory: first, restrict UPDATE … PATCH access exclusively to callers who already hold SELECT permission on every field of the target record, since the bypass exposes nothing those callers cannot already read - note this may require auditing and tightening existing permission grants and could break workflows that currently allow PATCH without full SELECT; second, replace all JSON Patch mutations with explicit SET or MERGE clauses, which accept no JSON Patch operations and eliminate the attack surface entirely, though this requires application-layer changes to query patterns. Full advisory: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-fpxg-5xmv-922m.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today