Executive brief
SurrealDB is a multi-model database used for managing complex data structures. A vulnerability exists where users with permission to update records can bypass security restrictions to read sensitive data they are normally forbidden from seeing. By intentionally triggering specific error messages, an attacker can force the database to reveal the contents of hidden fields, potentially leading to the exposure of private user information or internal data.
Technical details
A information disclosure vulnerability (CWE-209) exists in SurrealDB where arithmetic operators and the `extend` function embed raw operand values into error messages. While field-level SELECT permissions may hide certain fields from a user, UPDATE permission checks are evaluated against the unreduced document. An authenticated attacker with UPDATE access can craft a query that performs an incompatible operation on a hidden field (e.g., adding an integer to a hidden string field). The resulting error message includes the raw value of the hidden field, allowing the attacker to exfiltrate data one field at a time. This has been patched in version 3.1.0 by ensuring error messages only return type names rather than raw values.
Affected products
- SurrealDB surrealdb < 3.1.0
Timeline
- 2026-05-12: patched: Fix committed to repository
- 2026-05-27: disclosed: Initial advisory publication
- 2026-07-01: advisory: Advisory updated/reviewed on GitHub