CVE-2026-109337

MEDIUMCVSS 4.3

Description

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.

Timeline

Published:October 12th, 2026 5:17 PM

Last modified:October 15th, 2026 3:17 AM

CVSS Scoring

CVSS v3: 4.3 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-203

References & Reports

Advisories, patches, and third-party reports

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jm88-9wvx-6h4q
https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-field-permission-bypass-via-live-select-where-clause

Source: NIST NVD · Data may lag official sources by up to one minute