Description
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive exact stored values in CREATE, UPDATE, and DELETE notifications.
Published: 2026-10-12
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data exposure via field permission bypass
Action: Patch
AI Analysis

Impact

SurrealDB before version 3.3.0 contains an authorization bypass that allows users who normally cannot view certain fields to retrieve the exact stored values by exploiting the LIVE SELECT feature within the $before and $after parameters. The flaw permits projection of restricted fields through an alias, enabling extraction of confidential data during CREATE, UPDATE, and DELETE notifications.

Affected Systems

The vulnerability impacts the SurrealDB database product from the SurrealDB vendor. All installations running version 3.2.x and earlier are affected, as the issue was fixed in release 3.3.0.

Risk and Exploitability

The flaw has a CVSS score of 5.3, indicating moderate severity. EPSS data is not available, so the likelihood of exploitation is currently unknown, and it is not listed in CISA's KEV catalog. Attackers would need to have a valid user account with access to the relevant records to leverage this issue; the attack vector is local to the database context and requires use of the LIVE SELECT feature.

Generated by OpenCVE AI on October 12, 2026 at 19:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade SurrealDB to version 3.3.0 or later to apply the vendor fix.
  • If an upgrade cannot be performed immediately, restrict the use of $before and $after projections in LIVE SELECT notifications by disabling them for accounts that do not require access to sensitive fields.
  • Reconfigure field-level SELECT permissions to ensure that only authorized roles can view protected fields, and validate the configuration by testing non-privileged accounts to confirm that the bypass cannot occur.

Generated by OpenCVE AI on October 12, 2026 at 19:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive exact stored values in CREATE, UPDATE, and DELETE notifications.
Title SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after
First Time appeared Surrealdb
Surrealdb surrealdb
Weaknesses CWE-863
CPEs cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*
Vendors & Products Surrealdb
Surrealdb surrealdb
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Surrealdb Surrealdb
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-26T16:46:48.474Z

Reserved: 2026-10-12T14:18:12.390Z

Link: CVE-2026-109336

cve-icon Vulnrichment

Updated: 2026-10-26T16:42:34.270Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T17:17:29.710

Modified: 2026-10-26T17:17:12.857

Link: CVE-2026-109336

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T20:00:14Z

Weaknesses