Threats tagged 'ghsa-6g9v-7gq3-p2c6'

SurrealDB versions prior to 3.1.0 contain a vulnerability where authenticated users with UPDATE permissions can read field values hidden by field-level SELECT permissions through error messages. This occurs because arithmetic operators and the extend function embed raw operand values in error messages, revealing sensitive data. A patch is available in version 3.1.0 and later that replaces raw operand values in errors with their type names, preventing information disclosure.