SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT… (CVE-2026-109336)

CVE-2026-109336 describes an authorization bypass vulnerability in SurrealDB prior to version 3.3.0. The flaw allows record users to circumvent field-level SELECT permissions and read fields that are intended to be hidden. This is achieved through LIVE SELECT projections where attackers exploit the unreduced $after or $before parameters by aliasing restricted fields to obtain exact stored values during database notifications triggered by CREATE, UPDATE, and DELETE operations.

The vulnerability allows unauthorized disclosure of restricted data fields that should be hidden by field-level permissions. Although it does not affect data integrity or availability, it compromises confidentiality by enabling unauthorized users to read sensitive information.

A fix is available in SurrealDB version 3.3.0. Users should upgrade to version 3.3.0 or later to remediate this authorization bypass vulnerability. No additional mitigation steps are indicated.