SurrealDB versions up to 3.1.3 contain a vulnerability where SELECT permissions on array elements (field.*) are not properly enforced for record users. This flaw causes denied array elements to be leaked instead of hidden, allowing attackers with record scope access to read data they should not be able to access. The issue arises from incorrect index handling during permission filtering. This vulnerability has a CVSS score of 6.5, indicating a high severity impact on confidentiality without affecting integrity or availability.