Executive brief
SurrealDB is a multi-model database used for managing structured and unstructured data. A security flaw in how the database handles specific counting queries allows users to bypass field-level security restrictions. By repeatedly guessing values and checking the count results, an attacker could discover sensitive information they are not authorized to see, such as private user data or restricted internal identifiers.
Technical details
A vulnerability exists in SurrealDB's query planner where indexed COUNT fast paths (such as Index::Count or IndexCountScan) bypass field-level SELECT permissions. When a field is protected by a 'DEFINE FIELD ... PERMISSIONS FOR select' clause but is also indexed, the database uses a shortcut to count matching index entries without verifying if the caller has permission to read that field. An authenticated attacker with table-level SELECT access can exploit this by executing 'SELECT count() ... WHERE hidden_field = "guess"' queries. By observing non-zero counts, the attacker can confirm or brute-force the contents of restricted fields. This issue is resolved in version 3.1.0 by ensuring the query planner refuses indexed fast paths when the query touches fields with restricted SELECT permissions.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: NVD publication date
- 3.1.0: patched: Vulnerability fixed in version 3.1.0