SurrealDB versions prior to 3.1.0 allow attackers to bypass field-level SELECT permissions by using the indexed COUNT fast path. When a COUNT query is issued on a field that is normally restricted, the database returns a count that can be used to infer the presence or absence of records and, through repeated guessing, to recover the actual value of the restricted field. This effectively lets an adversary read protected data, violating confidentiality and bypassing the intended permission model, as defined by CWE-863.

All installations of SurrealDB running a version earlier than 3.1.0 are affected. The flaw exists in the database engine’s handling of COUNT queries on indexed fields; therefore any instance exposing this functionality, regardless of network exposure or user role, may be vulnerable.

The vulnerability has a CVSS score of 5.3, indicating moderate severity, and an EPSS score of less than 1 %, indicating a low likelihood of exploitation at this time. The flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need to reach the database query interface, either through a trusted client or by exploiting a misconfigured or exposed endpoint, to execute the exploit with no special privileges. Based on the description, it can be inferred that the attack simply involves sending specially crafted COUNT statements, making it straightforward to automate and not requiring code execution or privilege escalation.