SurrealDB versions prior to 3.1.0 evaluate user‑supplied WHERE clauses before enforcing SELECT WHERE permissions, allowing an authenticated user to access full table contents regardless of table‑level restrictions. This flaw can be triggered through SELECT statements or various update operations that include WHERE clauses, and may also be leveraged via scripting functions, SurrealQL THROW statements, or side‑channel timing attacks. The resulting data exfiltration is limited to the attacker’s current database and cannot cross namespace or database boundaries.

The vulnerability affects SurrealDB deployments running any version before 3.1.0. Users with authentication—whether record or scope users—can exploit the flaw, and the issue is present across all database tables in the affected installations.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score indicates an exploitation probability of less than 1%, and the vulnerability is not listed in CISA’s KEV catalog. Because the attack requires authentication and relies on ordering of permission checks, an attacker must already possess valid database credentials, but the scenario is realistic for compromised or privileged accounts. Exploitation can be most efficient when scripting is allowed, yet alternative methods reduce reliance on that feature.