SurrealDB versions 3.1.0 through 3.1.4 do not enforce field‑level SELECT permissions when records are retrieved via graph-edge or back‑reference traversals. An attacker who has table‑level SELECT privileges can trigger a graph traversal that materializes the full record, thereby reading fields that should otherwise be hidden by field‑level permissions. This flaw is classified as a permission bypass and could lead to disclosure of sensitive data stored in protected fields.

The vulnerability affects SurrealDB 3.1.0 up through the last minor release before 3.1.5. All installation instances running any of those versions may be impacted, regardless of deployment size or environment.

The CVSS score of 5.3 indicates a moderate severity, and the EPSS score of < 1% indicates a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Exploitation requires that the attacker is able to submit graph‑traversal queries with table‑level SELECT privileges, a scenario that can arise in applications that expose the database API to authenticated users. Because the attack vector does not rely on arbitrary code execution, the impact is limited to information disclosure and the risk is primarily that of leaking sensitive data rather than platform compromise.