Description
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| surrealdb | surrealdb | < 3.3.0 | 3.3.0 |
References
- GitHub Security Advisory (GHSA-jm88-9wvx-6h4q) vendor-advisory
- VulnCheck Advisory: SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause third-party-advisory