CVE-2026-109337 — SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT W…
Published: 2026-10-12 · CVSS: 5.3 · CVSS 4.0
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7