SurrealDB versions 3.1.0 before 3.1.5 have a vulnerability where field-level SELECT permissions are bypassed when accessing records via graph-edge or back-reference traversals. This allows attackers with table-level SELECT access to read fields that should be restricted by field-level permissions. The issue arises because permissions are not enforced correctly during these traversal queries.