SurrealDB versions prior to 2.0.4 fail to enforce field-level permissions correctly across multiple query operations including SELECT, UPDATE, and DELETE. Authorized users can bypass intended access controls and retrieve unauthorized field data by leveraging query constructs like SELECT VALUE, aliasing fields, passing fields as function arguments, filtering with WHERE clauses, using RETURN BEFORE clauses, and referencing fields in SET clauses. This vulnerability is tracked as CVE-2024-58367 and is categorized under CWE-285 (Improper Authorization). No patch or remediation details are provided in the available data.

The vulnerability allows authorized users to access and leak field values they are not authorized to view, violating data confidentiality controls within SurrealDB. This could lead to unauthorized disclosure of sensitive information stored in protected fields. The flaw affects the integrity of access control enforcement at the field level during database query operations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict database user permissions to the minimum necessary and monitor for unusual query patterns that might exploit this weakness. Avoid granting broad SELECT, UPDATE, or DELETE permissions to users who do not require them.