SurrealDB versions prior to 3.1.4 allow unauthorized disclosure of array elements that should be protected by SELECT permissions. The flaw results from incorrect handling of permission filtering when array indices are accessed, causing denied entries to be returned instead of being omitted. This permits an attacker to retrieve confidential data that belongs to another user or role. The vulnerability is classified as a permission bypass following CWE‑863 standard.

The affected product is SurrealDB by SurrealDB Inc. The vulnerability exists in all releases earlier than version 3.1.4. Upgrading to v3.1.4 or later removes the flaw.

With a CVSS score of 7.1 the risk is considered high. The EPSS score is < 1%, indicating a very low but non‑zero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is through record‑scope access; an attacker who can issue SELECT queries against a record with array fields can exploit the mis‑indexed permission checks to read elements that should be hidden. Once the record scope is obtained, the attacker can read any denied array element, compromising confidentiality for the affected applications.