Executive brief
Duplicate Advisory: SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`
Affected products
- crates.io surrealdb
Junglewise Threat Intelligence
Duplicate Advisory: SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`
Severity: low · CVSS 3.1 · Published 2026-07-20
Technologies: surrealdb (crates.io). Vendors: crates.io.
Related threats
- SurrealDB JSON parser denial of service via uncontrolled recursion
- Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects
- Duplicate Advisory: SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation
- SurrealDB ES512 algorithm silently downgraded to ES384
- Duplicate Advisory: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries