Duplicate Advisory: SurrealDB: Scraping a TABLE with no available PERMISSIONS to current auth level

SurrealDB prior to version 3.1.0 improperly orders evaluation of user-supplied WHERE clauses in SELECT and update-related statements, applying them against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. This allows authenticated users, including those with limited Record and Scope user privileges, to bypass table-level permission checks and access full table contents within the database they are authenticated against. Exploitation is facilitated by scripting functions when enabled, but also possible through SurrealQL's THROW statement and timing-based side channels. The vulnerability is confined to the current database context and does not cross namespace or database isolation boundaries.

An authenticated user with limited permissions can read the full contents of any table in the database they have access to, bypassing intended table-level permission restrictions. This results in unauthorized data disclosure (confidentiality impact). There is no impact on data integrity or availability. The vulnerability affects only the current database and does not allow access across namespaces or other databases.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, consider disabling scripting functions (--allow-scripting) to reduce exploitation risk, as scripting facilitates more direct exfiltration. Restrict authenticated user privileges to the minimum necessary to limit potential impact.