SurrealDB versions prior to 3.1.0 contain a field-level permission bypass in JSON Patch operations. A flaw identified as CWE-863 (Missing Authorization) allows an authenticated user to read protected fields by sending an UPDATE PATCH that uses an empty 'from' pointer in copy or move operations. By duplicating all record fields—including those restricted by SELECT permissions—into attacker-chosen destinations, the attacker can access data that should remain confidential, resulting in an information disclosure vulnerability.

All releases of SurrealDB before version 3.1.0 are affected, as identified by the vendor surrealdb:surrealdb. No sub-version filter is listed, so any unpatched installation of SurrealDB is vulnerable.

The CVSS score of 5.3 indicates medium severity, and the <1% EPSS score suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to the database and must use the JSON Patch API. By crafting a PATCH request containing an empty 'from' pointer, the attacker can read protected fields without modifying or deleting data, and the impact is limited to the data viewable under the user’s current authorizations.