SurrealDB before version 3.3.0 contains an authorization bypass that lets users with record-level access infer the values of fields hidden by field-level SELECT permissions. By using LIVE SELECT WHERE predicates over $before or $after, an attacker can repeatedly apply conditions and observe whether notifications are triggered on create, update, or delete events. Each observation confirms whether a predicate matches, allowing the attacker to deduce restricted field values incrementally.

All installations of SurrealDB that are built from source or distributed through standard channels with a version number lower than 3.3.0 are affected. The product is the SurrealDB database service, and any environment where field-level permissions are configured applies to these vulnerable versions.

The CVSS score of 5.3 indicates moderate impact, and the EPSS score is not available. The vulnerability is not listed in CISA KEV, suggesting no high‑profile exploitation yet. Attackers need to send crafted LIVE SELECT queries and monitor notification events; therefore the attack vector is application‑level and requires some level of authenticated access to the database. Because it allows leakage of protected data, the risk remains significant for data‑sensitive deployments, even if no code execution or denial of service is possible.