Executive brief
SurrealDB, a multi-model database, contains a vulnerability where users can bypass field-level security restrictions. By using specific counting queries on indexed fields, an unauthorized user can deduce the contents of hidden data that they are not permitted to see. This could lead to the exposure of sensitive information, though it does not allow the attacker to modify data or crash the system.
Technical details
An authorization bypass exists in SurrealDB's query planner (both legacy and streaming versions) when handling indexed fields. When a field is protected by field-level SELECT permissions but is also indexed, the query planner may use an 'indexed-COUNT' shortcut (such as Index::Count or IndexCountScan) that bypasses the standard permission checks. An attacker with table-level SELECT access can perform a brute-force or 'guess-and-check' attack by issuing 'SELECT count() ... WHERE hidden_field = "guess" GROUP ALL' queries. If the count returns greater than zero, the attacker confirms the value of the restricted field. The vulnerability is fixed in version 3.1.0 by ensuring the planner refuses indexed fast paths when the query references fields with restricted permissions.
Affected products
- surrealdb surrealdb < 3.1.0
Timeline
- 2026-05-25: patched: Fix committed to repository
- 2026-05-27: disclosed: Advisory published by maintainers
- 2026-07-01: advisory: GitHub Advisory reviewed and updated