CVE-2026-63742 Details

A field-level SELECT permission bypass vulnerability has been identified in SurrealDB versions prior to 3.1.0. This vulnerability allows attackers to execute COUNT queries on indexed fields that have SELECT restrictions, enabling them to confirm or recover restricted field values through repeated guesses. The issue arises because the query planner's indexed COUNT fast paths bypass the necessary permission checks, allowing access to hidden data.

Users can upgrade to SurrealDB version 3.1.0 or later, where this vulnerability has been patched. Alternatively, avoid indexing fields that are protected by SELECT permissions, restrict the ability to run COUNT queries on tables with field-protected columns, or use database isolation as a boundary where feasible.