SurrealDB array element-level SELECT permissions bypass

Severity: medium · CVSS 6.5 · Published 2026-07-20

SurrealDB is a distributed database engine used for storing and querying structured data with fine-grained access control. A vulnerability in versions before 3.1.4 allows users with record-level access to bypass array element-level SELECT permissions and read data that should be hidden from them. Attackers can selectively retrieve denied array elements by exploiting incorrect index handling during permission filtering, compromising data confidentiality without requiring elevated privileges.

Technologies: surrealdb (crates.io). Vendors: crates.io.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 6.5, published 20 July 2026.
Which products and versions are affected?
surrealdb (crates.io) <= 3.1.3.
Is there a fix for This vulnerability?
A patch was published on 2026-07-20: Fix deployed in SurrealDB 3.1.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network, in a software library.
Am I affected?
Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an authorization bypass (CWE-863) affecting array element-level permission filtering in SurrealDB's permission system. When evaluating DEFINE FIELD field.* PERMISSIONS FOR select directives, the permission enforcement logic incorrectly removes denied elements by index while iterating forward through an array. Because removing an element shifts subsequent indices, the loop's pending index references become invalid, leaving denied elements unfiltered. The flaw exists in three code paths (doc/reduce.rs, doc/output.rs, exec/operators/scan/pipeline.rs) and only affects RECORD users; root and record-owner sessions enforce permissions correctly. An attacker with network access and RECORD scope credentials can issue SELECT queries to read array elements that should be restricted. The fix, included in SurrealDB 3.1.4, removes denied elements in reverse index order to prevent index invalidation. Field-level permissions and namespace/database isolation are not affected.

Affected products

  • SurrealDB SurrealDB < 3.1.4

Timeline

  • 2026-06-10: disclosed: Original advisory published by SurrealDB team (GHSA-8rw6-p7m8-63jp)
  • 2026-07-20: advisory: Duplicate advisory GHSA-j6mj-v752-pp4x published to GitHub Advisory Database and NVD
  • 2026-07-20: patched: Fix deployed in SurrealDB 3.1.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.