EUVD-2026-45913
GHSA-5c44-88qh-4c5h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Requires authenticated record user with table SELECT (PR:L); indexed COUNT bypass yields only incremental confidentiality disclosure (C:L); no integrity, availability, or scope-change impact applies.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries on indexed fields with field-level SELECT restrictions to confirm or recover restricted field values through repeated guesses.
AnalysisAI
SurrealDB before version 3.1.0 leaks restricted field values to authenticated record users by exploiting an indexed COUNT query optimization that skips field-level SELECT permission checks. When a field is protected by DEFINE FIELD ... PERMISSIONS FOR select but is also covered by a DEFINE INDEX, an attacker holding table-level SELECT can confirm or enumerate the field's contents by submitting SELECT count() FROM t WHERE hidden_field = 'guess' GROUP ALL - the query planner's indexed fast path returns a nonzero count for correct guesses without ever evaluating the permission predicate. No public exploit exists and the vulnerability is not in CISA KEV; however, the attack is straightforwardly reconstructable from the detailed vendor advisory.
Technical ContextAI
SurrealDB is a multi-model database written in Rust (crate: surrealdb). The root cause is CWE-863 (Incorrect Authorization): the query planner offers multiple indexed COUNT execution paths - Index::Count, IndexCountScan, and the legacy Iterate Index Count / Iterate Index Keys paths - that resolve predicates against B-tree or unique index entries and return row counts without first evaluating the field-level permission predicate that the non-indexed path enforces. SurrealDB's DEFINE FIELD ... PERMISSIONS FOR select WHERE ... construct is the intended mechanism for hiding field contents from callers who do not satisfy the permission expression, but the optimization short-circuits before this check fires. The same query issued WITH NOINDEX correctly returns [] because it falls through to the permission-aware code path. Both the legacy planner (surrealdb/core/src/idx/planner/tree.rs) and the streaming planner (surrealdb/core/src/exec/planner/select/mod.rs) contained the gap. The affected package is the Rust crate surrealdb for all versions prior to 3.1.0.
RemediationAI
Upgrade SurrealDB to version 3.1.0 or later, which patches both the legacy planner and the streaming planner to refuse the indexed COUNT fast path when WHERE or ORDER predicates reference fields governed by a non-Full SELECT permission. The upstream fix is tracked in GitHub pull request https://github.com/surrealdb/surrealdb/pull/240 and commit 0c6dd021bb55b32a78a553c72bb9c0cdd414825f; the patched release version 3.1.0 is confirmed by the vendor advisory at https://github.com/surrealdb/surrealdb/security/advisories/GHSA-c8jx-96c9-8xrp. For deployments that cannot upgrade immediately, the vendor advisory recommends removing DEFINE INDEX definitions from fields that carry DEFINE FIELD ... PERMISSIONS FOR select restrictions - this forces all queries through the non-optimized path, which correctly enforces permissions, but carries a query performance trade-off for large tables. As a detection control, audit query logs for high-frequency COUNT queries against the same table with varying WHERE predicates on sensitive fields, which would indicate enumeration attempts.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today