CVE-2026-109341 Details

An authorization bypass vulnerability has been identified in SurrealDB versions prior to 3.3.0. This vulnerability allows users with table-level write permissions to access fields restricted by SELECT permissions. The issue arises because JSON Patch pointers can be resolved against the full record, bypassing field-level restrictions. Attackers can exploit this by using PATCH copy or move operations to transfer hidden fields to accessible locations, or by manipulating test mismatch errors to extract sensitive information.

Users should update to SurrealDB version 3.3.0 or later, where this vulnerability has been patched. For those unable to update, consider not granting table-level write permissions to users who should not have access to certain SELECT-restricted fields. Instead, restrict permissions at the table level or relocate sensitive fields to a separate table. If less-trusted users need to write through controlled paths, route their writes via DEFINE API endpoints or functions, and deny them arbitrary queries.