CVE-2026-109341

SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations

State: Published
Severity: 7.1 High
Published: Oct 12, 2026
Updated: Oct 26, 2026
Reserved: Oct 12, 2026

Description

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into readable destinations, or abuse test mismatch errors as a disclosure oracle.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N	VulnCheck

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
surrealdbsurrealdb	before 3.3.0Affected 3.3.0Not affected

References

GitHub Security Advisory (GHSA-h2c3-549c-gjpr)vendor-advisory
VulnCheck Advisory: SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operationsthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.