Duplicate Advisory: SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages

SurrealDB prior to version 3.1.0 contains an information disclosure vulnerability (CWE-209) that allows authenticated users with UPDATE access to bypass field-level SELECT permissions. By triggering arithmetic or extend operations on fields hidden by SELECT permissions, attackers can cause error messages to reveal raw operand values. This leakage exposes sensitive field data that should remain inaccessible, effectively circumventing intended access controls. The vulnerability has a CVSS 3.1 base score of 4.3, indicating a medium severity impact focused on confidentiality loss without integrity or availability impact.

Authenticated users with UPDATE privileges can obtain sensitive field data that should be hidden by SELECT permissions through error message leakage. This results in partial confidentiality loss of protected data fields. There is no impact on data integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict UPDATE permissions to trusted users only and monitor for unusual error message patterns that may indicate exploitation attempts.