SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT… (CVE-2026-109337)

SurrealDB prior to version 3.3.0 contains an authorization bypass vulnerability (CVE-2026-109337) where users with record access can infer values of fields that are supposed to be hidden by field-level SELECT permissions. The exploit involves crafting repeated LIVE SELECT WHERE predicates using temporal variables $before or $after and monitoring whether notifications are triggered on record lifecycle events (CREATE, UPDATE, DELETE). This side-channel allows attackers to deduce restricted field values despite access controls.

The vulnerability results in unauthorized information disclosure of field values that should be hidden by field-level SELECT permissions. It does not affect integrity or availability but can lead to leakage of sensitive data through inference. The CVSS score is 4.3 (medium severity), indicating limited impact confined to confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict record user privileges and monitor for suspicious use of LIVE SELECT WHERE predicates involving $before or $after. Avoid exposing sensitive fields via field-level SELECT permissions where possible.