SurrealDB versions before 2.0.4 do not enforce field permissions correctly on SELECT, UPDATE and DELETE operations, allowing authenticated users to read values from fields for which they lack SELECT rights. The flaw can be exploited through several query techniques, including SELECT VALUE operations, field aliasing, function arguments, where-clause filtering, RETURN BEFORE clauses and SET clause references, enabling the extraction of protected data without authorization.

The vulnerability affects all installations of SurrealDB using a version earlier than 2.0.4. Any deployment of this database engine that has not been updated to the patched release is exposed, regardless of the operating environment.

With a CVSS score of 7.1 the vulnerability is considered high severity, but its EPSS score of less than 1% suggests a low likelihood of exploitation at present and it is not listed in the CISA KEV catalog. The attack vector requires an authenticated database user who can craft and execute queries; the flaw does not provide privilege escalation or remote code execution, but it does enable a breach of confidentiality by leaking protected field data.