SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from` (CVE-2026-63751)

SurrealDB allows modification of records using JSON Patch operations via `UPDATE … PATCH`. The `copy` operation with an empty `from` pointer was incorrectly handled as copying the entire record, including fields protected by field-level SELECT permissions. The permission filter only hid original protected field names, not the duplicated fields, resulting in unauthorized disclosure of protected data within the same record. This vulnerability affects versions prior to 3.1.0. A patch introduced in version 3.1.0 rejects empty `from` pointers for `copy` and `move` operations, preventing this bypass. Workarounds include restricting `UPDATE … PATCH` to users with full SELECT permissions on all fields or using explicit `SET` or `MERGE` clauses instead of JSON Patch.

An authenticated user with permission to perform `UPDATE … PATCH` on a record can bypass field-level SELECT permissions and read any field's value within that record. The confidentiality of protected fields is compromised, but the impact is limited to the single targeted record and does not affect other records or data outside the record's scope. There is no impact on integrity or availability.

A patch is available in SurrealDB version 3.1.0 and later that rejects empty `from` pointers in `copy` and `move` JSON Patch operations, effectively fixing the vulnerability. Users unable to upgrade should restrict `UPDATE … PATCH` operations to callers who already have SELECT permission on all fields of the target record, or switch to using explicit `SET` or `MERGE` clauses instead of JSON Patch operations to avoid the attack surface.