Duplicate Advisory: SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`

SurrealDB before version 3.1.0 contains a field-level permission bypass vulnerability (CWE-863) in its JSON Patch implementation. Authenticated users can exploit the UPDATE PATCH method with 'copy' or 'move' operations that have an empty 'from' pointer to duplicate all fields of a record, including those normally restricted by field-level SELECT permissions, into fields they control. This effectively allows unauthorized reading of protected data fields. The advisory is a duplicate of GHSA-fpxg-5xmv-922m and has been withdrawn to preserve external references.

The vulnerability allows an authenticated user to read data from fields that should be protected by field-level SELECT permissions by duplicating those fields into accessible locations. This results in unauthorized disclosure of sensitive information. There is no impact on data integrity or availability reported. The CVSS score is 4.3 (medium severity), indicating limited impact confined to confidentiality with low attack complexity and requiring privileges.

A fixed version is SurrealDB 3.1.0 or later. Users should upgrade to version 3.1.0 or above to remediate this vulnerability. Since no patch links are provided in this advisory, users should consult the vendor advisory GHSA-fpxg-5xmv-922m for official remediation guidance. No additional mitigations are indicated.