Threats tagged 'ghsa-8x38-ppf2-349c'

SurrealDB versions from 3.1.0 up to but not including 3.3.0 contain an authorization vulnerability that allows users with record access to infer values of restricted fields. This occurs because the query planner uses indexes on fields protected by restrictive SELECT permissions, enabling attackers to perform specific queries that reveal information about restricted data.