Executive brief
SurrealDB is a distributed database engine used for storing and querying structured data with fine-grained access control. A vulnerability in versions before 3.1.4 allows users with record-level access to bypass array element-level SELECT permissions and read data that should be hidden from them. Attackers can selectively retrieve denied array elements by exploiting incorrect index handling during permission filtering, compromising data confidentiality without requiring elevated privileges.
Technical details
The vulnerability is an authorization bypass (CWE-863) affecting array element-level permission filtering in SurrealDB's permission system. When evaluating DEFINE FIELD field.* PERMISSIONS FOR select directives, the permission enforcement logic incorrectly removes denied elements by index while iterating forward through an array. Because removing an element shifts subsequent indices, the loop's pending index references become invalid, leaving denied elements unfiltered. The flaw exists in three code paths (doc/reduce.rs, doc/output.rs, exec/operators/scan/pipeline.rs) and only affects RECORD users; root and record-owner sessions enforce permissions correctly. An attacker with network access and RECORD scope credentials can issue SELECT queries to read array elements that should be restricted. The fix, included in SurrealDB 3.1.4, removes denied elements in reverse index order to prevent index invalidation. Field-level permissions and namespace/database isolation are not affected.
Affected products
- SurrealDB SurrealDB < 3.1.4
Timeline
- 2026-06-10: disclosed: Original advisory published by SurrealDB team (GHSA-8rw6-p7m8-63jp)
- 2026-07-20: advisory: Duplicate advisory GHSA-j6mj-v752-pp4x published to GitHub Advisory Database and NVD
- 2026-07-20: patched: Fix deployed in SurrealDB 3.1.4