Duplicate Advisory: SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

SurrealDB versions <=3.1.3 fail to correctly enforce SELECT permissions on array elements at the element level for record users. Due to improper index handling during permission filtering, users with record scope access can read array elements that should be denied by element-level permissions. This results in unauthorized data disclosure of array elements that should be hidden. The vulnerability is tracked as CWE-863 (Incorrect Authorization) and has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). No known exploits are reported in the wild. The advisory is a duplicate of GHSA-8rw6-p7m8-63jp and affects the crates.io ecosystem.

An attacker with record scope access can bypass element-level SELECT permissions on array fields, leading to unauthorized disclosure of sensitive array elements. The confidentiality of data is compromised, but integrity and availability remain unaffected. This could expose sensitive information to unauthorized users within the application context.

A fixed version 3.1.4 or later should be used to remediate this vulnerability. Since the advisory states versions up to 3.1.3 are affected, upgrading to 3.1.4 or newer is recommended. No patch links were provided in the input, so users should consult the official SurrealDB vendor advisory or repository for the official fix. There is no indication that this vulnerability is mitigated by configuration or other means.