Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121418SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner

Medium 4.3

In plain English

A medium-severity incorrect authorization in surrealdb from surrealdb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 89.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors.

Affected products (as reported)

Vendor	Product	Versions
surrealdb	surrealdb	3.1.0 – before 3.3.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-x6mm-9295-rvph) vendor-advisory
VulnCheck Advisory: SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner third-party-advisory