SurrealDB versions prior to 3.1.0 contain a vulnerability in the JSON Patch `copy` and `move` operations used in `UPDATE … PATCH` statements. Specifically, using an empty `from` pointer causes the entire record to be copied, bypassing field-level SELECT permissions and exposing protected field values under new field names. This vulnerability allows an authenticated user with update patch permissions to read any field in the targeted record regardless of select restrictions. The issue is limited to confidentiality impact and does not expose data from other records. Versions 3.1.0 and later include a patch that rejects empty `from` pointers, mitigating this issue.