SurrealDB versions earlier than 3.1.0 expose sensitive data by including hidden field values in error messages when an authenticated user with UPDATE rights performs an arithmetic or extend operation on a field that the user is not permitted to SELECT. The flaw is a CWE-209 vulnerability that allows an attacker to learn private values that should be protected by field‑level SELECT controls. This vulnerability directly compromises the confidentiality of restricted data without affecting integrity or availability.

The flaw impacts SurrealDB releases that precede 3.1.0. No further specific sub‑versions are listed, meaning any build older than 3.1.0 is considered vulnerable.

The CVSS score of 5.3 marks the issue as moderate severity, while the EPSS score of less than 1% indicates a very low likelihood of real‑world exploitation. The CVE is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with UPDATE permissions; once those prerequisites are satisfied, an attacker can construct a request that forces an error to be generated, causing the database to return the hidden field value. Given the required access, the risk is moderate but should be mitigated promptly.