Duplicate Advisory: SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals

SurrealDB versions 3.1.0 up to but not including 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. An attacker who has table-level SELECT access can exploit this flaw to read field values that are normally hidden by field-level permissions by materializing records through graph traversals rather than direct table scans. This vulnerability is classified under CWE-863 (Incorrect Authorization).

The vulnerability allows unauthorized disclosure of data fields that should be protected by field-level permissions. Attackers with table-level SELECT access can bypass these restrictions and read sensitive information. There is no impact on data integrity or availability reported. The CVSS score is 4.3 (medium severity), indicating limited confidentiality impact without integrity or availability effects.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links are provided and the advisory is a duplicate, users should monitor the original advisory GHSA-hv6h-hc26-q48p for updates and apply any official fixes once available. Until then, restrict table-level SELECT permissions to trusted users only to reduce risk.