SurrealDB versions prior to 3.1.4 contain a vulnerability where array element-level SELECT permissions (field.*) are not correctly enforced for record users. This causes denied array elements to be partially leaked in query results. The issue affects only element-level permissions for record users, not field-level permissions or root/record-owner sessions. The vulnerability impacts confidentiality but does not allow data modification or privilege escalation. A fix is available in SurrealDB 3.1.4.