Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109341SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations

High 7.1

In plain English

A high-severity information exposure in surrealdb from surrealdb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.3%top 82.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into readable destinations, or abuse test mismatch errors as a disclosure oracle.

Affected products (as reported)

Vendor	Product	Versions
surrealdb	surrealdb	0 – before 3.3.0

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-h2c3-549c-gjpr) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations third-party-advisory