SurrealDB versions prior to 3.1.0 have a vulnerability that allows authenticated users to bypass field-level SELECT permissions via JSON Patch operations. Specifically, using UPDATE PATCH with an empty 'from' pointer in 'copy' or 'move' operations enables duplication of all record fields, including those protected by field-level permissions, into attacker-controlled destination fields. This vulnerability has been withdrawn as a duplicate advisory but remains relevant for versions before 3.1.0.