SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages (CVE-2026-63748)

In SurrealDB versions before 3.1.0, a user with UPDATE access can exploit error messages generated by arithmetic operations or the extend function to read field values that should be hidden by field-level SELECT permissions. This happens because UPDATE permission checks evaluate against the full document, and error messages embed the raw operand values, leaking sensitive information. The vulnerability is tracked as CVE-2026-63748 and has a CVSS 3.1 base score of 4.3 (medium severity). The issue is fixed in SurrealDB 3.1.0 by replacing raw operand values in error messages with their type names, thus preventing unintended data exposure.

An authenticated user with UPDATE permission can infer the value of hidden fields by triggering errors that include the raw operand values in error messages. This allows reading one hidden field value per operation on any record they can update, potentially exposing sensitive information that should be protected by field-level SELECT permissions. The vulnerability does not affect confidentiality beyond this information disclosure and does not impact integrity or availability.

A patch is available in SurrealDB version 3.1.0 and later that addresses this vulnerability by sanitizing error messages. Users should upgrade to version 3.1.0 or later to remediate this issue. As a workaround, if upgrading is not immediately possible, avoid granting UPDATE permissions on records where field-level SELECT permissions are intended to hide values from the same user.