SurrealDB versions before 3.1.0 contain a vulnerability where user-supplied WHERE clauses in various query statements are evaluated against full record data before permission checks are enforced. This flaw allows authenticated users to bypass table-level permissions and read the full contents of any table within their current database. Exploitation is easier when scripting is enabled but can also occur through other SurrealQL features. The issue does not affect cross-namespace or cross-database boundaries.