Threats tagged 'ghsa-hv6h-hc26-q48p'

SurrealDB versions 3.1.0 through 3.1.4 contain a vulnerability where field-level SELECT permissions can be bypassed via graph-edge or back-reference traversals. Users with table-level SELECT permission can access field values hidden by field-level restrictions when records are accessed through these traversal methods. This issue does not allow unauthorized access to records outside the user's table-level permissions and does not affect root or record-owner sessions. The vulnerability is fixed in version 3.1.5 and later.