EUVD-2026-45919
GHSA-p7hp-79jj-q923
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable (AV:N), low complexity, requires authenticated low-privileged UPDATE session (PR:L); only limited confidentiality disclosure, no integrity or availability impact.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw operand values in error responses, bypassing field-level access controls.
AnalysisAI
SurrealDB versions before 3.1.0 expose field values protected by field-level SELECT permissions through verbose error messages returned to authenticated users who hold UPDATE access. By issuing UPDATE statements that trigger arithmetic or extend operations against hidden fields - such as adding an integer to a string-typed email field - an attacker receives an error response embedding the raw operand value (e.g., 'Tried to compute "alice@example.com" + 1'). No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the technique is trivially repeatable across any field on any record the attacker holds UPDATE permission on.
Technical ContextAI
SurrealDB is a multi-model database written in Rust (package: rust/surrealdb) that implements record-level and field-level access controls. CWE-209 (Generation of Error Message Containing Sensitive Information) describes the root cause: arithmetic operators (try_add, try_mul, etc.) and the extend operation construct error messages by embedding the raw operand value rather than its type name. Crucially, UPDATE permission checks evaluate against the unreduced document, meaning the database resolves field values before applying SELECT-level field visibility filters. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) confirms network-reachable exploitation with low attack complexity by a low-privileged authenticated caller, with limited confidentiality impact confined to the vulnerable system.
RemediationAI
The primary fix is upgrading to SurrealDB 3.1.0 or later, where the patch replaces raw operand values in every try_* arithmetic operator and in extend with the operand's type name (e.g., 'string', 'int', 'array'), eliminating value leakage from error messages. The upstream commit is available at https://github.com/surrealdb/surrealdb/commit/0aaa332c79195e4c40275eb5224aed3d52f5cf90. For operators unable to upgrade immediately, the vendor's official workaround is to not grant UPDATE permission to any record user on records whose field-level SELECT permissions are expected to hide values from that same caller - in other words, avoid the permission intersection entirely. This workaround has an operational trade-off: it may require restructuring access control policies and may prevent legitimate UPDATE use cases from record users who should not see certain fields.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today