SurrealDB versions 3.0.0 through 3.2.x allow users with record-level SELECT permissions to indirectly read values that are normally hidden by field‑level permissions. The vulnerability exploits COMPUTED fields that derive from hidden fields, and can also leverage write RETURN clauses containing $before/$after references to reveal concealed data. This undermines confidentiality, enabling attackers to access sensitive information that should be protected by authorization controls, as identified by CWE‑200.

The affected product is SurrealDB, versions 3.0.0 up to but not including 3.3.0. This includes any deployment of SurrealDB 3.x series that has not yet been upgraded to the 3.3.0 release or later. No other vendors or products are listed as impacted.

The CVSS score of 7.1 places this flaw in the high‑severity range, indicating that an attacker can exploit it without special constraints. The EPSS score is not available, and the vulnerability is not included in the CISA KEV catalog, suggesting no publicly known exploitation yet. However, because the attack vector appears to be via normal database queries or write commands that a legitimate user can issue, the practical risk is high if sensitive data is stored in hidden fields and exposed through COMPUTED fields or RETURN clauses. In the absence of mitigation, any user who can query the database has the potential to read data that should remain confidential.