Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109337SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause

Medium 4.3

In plain English

A medium-severity security flaw in surrealdb from surrealdb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 84.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.

Affected products (as reported)

Vendor	Product	Versions
surrealdb	surrealdb	0 – before 3.3.0

Weakness: CWE-203 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-jm88-9wvx-6h4q) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause third-party-advisory