CVE-2026-109336 Details

An authorization bypass vulnerability has been identified in SurrealDB versions prior to 3.3.0. This vulnerability allows users with record-level access to read fields that are normally hidden by field-level SELECT permissions. The issue arises in LIVE SELECT projections, where restricted fields can be accessed through the unreduced $after or $before parameters by using an alias to bypass the permission restrictions. This exploitation enables the retrieval of exact stored values in CREATE, UPDATE, and DELETE notifications.

Users should update to SurrealDB version 3.3.0 or later, where this vulnerability has been patched. For those unable to update, it is recommended to avoid relying on field-level SELECT permissions to protect sensitive data from untrusted users. Instead, keep sensitive information in a separate table or database that is not accessible to those users, or apply restrictions at the table level. Additionally, users can deny live and arbitrary queries to untrusted principal classes.