SurrealDB's enforcement of SELECT permissions on array elements (field.*) is flawed for record users. When a SELECT permission denies access to certain array elements, the filtering logic removes denied elements in forward index order, causing index shifts that leave some denied elements visible. This results in partial leakage of denied array elements in query results. The problem does not affect field-level permissions or root/record-owner sessions. The issue is fixed by removing denied elements in reverse index order, preventing index invalidation during filtering. The fix is included in SurrealDB version 3.1.4.

An attacker with record user privileges can read array elements that should be hidden by element-level SELECT permissions, thereby leaking confidential data. This leakage occurs even with deny-all or per-element predicates. However, the vulnerability does not allow bypassing field-level permissions, does not affect root or record-owner sessions, does not cross namespace or database boundaries, and does not permit data modification, privilege escalation, or denial of service. The impact is limited to confidentiality loss.

A patch fixing this vulnerability is available in SurrealDB version 3.1.4. Users should upgrade to this version to resolve the issue. Until patched, avoid relying on element-level (field.*) SELECT permissions to hide data from record users; instead, use field-level permissions which are correctly enforced. Alternatively, restrict record users from selecting tables that use element-level permissions.