Description
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive exact stored values in CREATE, UPDATE, and DELETE notifications.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| surrealdb | surrealdb | < 3.3.0 | 3.3.0 |
References
- GitHub Security Advisory (GHSA-pm6c-q8rh-92m8) vendor-advisory
- VulnCheck Advisory: SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after third-party-advisory