SurrealDB versions prior to 3.3.0 suffer an authorization bypass that allows users with table‑level write permissions to read fields that are normally hidden by SELECT restrictions. The bug occurs when JSON Patch operations are applied to an unreduced record; attackers can resolve patch pointers and use PATCH copy or move commands to duplicate hidden fields to readable locations, or trigger test mismatch errors to infer the presence of hidden data.

Affected systems include SurrealDB database deployments running any release before 3.3.0. No product synonyms are listed; the vulnerability applies across all supported platforms of SurrealDB before the specified version.

The CVSS score of 7.1 indicates a high‑severity issue, while the EPSS is currently unavailable and the vulnerability is not in the CISA KEV catalog. Exploitation requires the attacker to possess write access to a table; from that position they can use JSON Patch copy/move or test operations to access protected fields, resulting in unauthorized disclosure of sensitive data.