SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level… (CVE-2026-109335)

SurrealDB versions 3.0.0 through before 3.3.0 contain an information disclosure vulnerability (CVE-2026-109335) where record users can bypass field-level SELECT permissions. This is achieved by exploiting COMPUTED fields that derive from hidden fields, allowing unauthorized reading of sensitive data. Additionally, attackers can leverage write RETURN clauses with $before/$after to expose hidden values. The vulnerability is classified under CWE-200 (Information Exposure) and has a CVSS v3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact.

An attacker with record-level privileges can read sensitive data that should be restricted by field-level SELECT permissions. This leads to unauthorized information disclosure, potentially exposing confidential or sensitive fields that are intended to be hidden. The vulnerability does not affect data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict record user privileges to minimize exposure and avoid using COMPUTED fields or write RETURN clauses that could expose hidden data. Monitor vendor channels for updates and apply patches promptly once released.