SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals (CVE-2026-63738)

In SurrealDB versions >=3.1.0 and <3.1.5, a flaw in the shared helper function 'resolve_record_batch' used by graph-edge and reference traversals caused field-level SELECT permissions to be bypassed. While direct SELECT queries enforce field-level filtering, traversals materialize full records without applying field-level filtering, exposing hidden field values to users with table-level SELECT permission. The issue is limited to confidentiality breaches of fields within accessible records and does not grant unauthorized cross-table or cross-namespace access. The fix in 3.1.5 ensures field-level SELECT permissions and computed fields are applied consistently during traversal record materialization.

An attacker or user with legitimate table-level SELECT permission can read confidential field values that should be hidden by field-level SELECT permissions by using graph-edge or back-reference traversals. This leads to partial confidentiality loss within records the user is authorized to read. There is no impact on data integrity or availability, no unauthorized access to other tables or namespaces, and root or record-owner sessions are unaffected.

A patch is available and included starting from SurrealDB version 3.1.5, which properly enforces field-level SELECT permissions during graph and reference traversals. Users should upgrade to version 3.1.5 or later to remediate this issue. As a workaround, the legacy executor can be forced using the '--planner-strategy compute-only' option. Additionally, avoid relying solely on field-level SELECT permissions to hide sensitive data on tables accessible via graph or reference traversals; instead, restrict access at the table level or use namespace/database isolation as a primary boundary.