CVE-2026-109335
Deferred Deferred - Pending Action

SurrealDB Information Disclosure via COMPUTED Fields

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN clauses with $before/$after to expose hidden values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109335
EUVD
EUVD-2026-97637

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb 3.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB versions 3.0.0 to 3.2.9 have an information disclosure vulnerability where authenticated users can bypass field-level SELECT permissions to read sensitive data hidden by those permissions. This occurs through COMPUTED fields, which can derive values from restricted fields or expose hidden data in RETURN clauses during write operations.

Detection Guidance

To detect this vulnerability, check if your SurrealDB version is between 3.0.0 and 3.2.9. Use the command: surrealdb version. If the version is within this range, the system is vulnerable. Additionally, review database schemas for COMPUTED fields that derive from hidden fields or use write RETURN clauses with $before/$after.

Impact Analysis

If you use SurrealDB versions 3.0.0 to 3.2.9, attackers with SELECT or write permissions could access sensitive data they are not authorized to view. This includes hidden fields in COMPUTED fields or values exposed via RETURN clauses in write operations.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected SurrealDB versions may face compliance violations due to potential exposure of personal or health information.

Mitigation Strategies

Upgrade SurrealDB to version 3.3.0 or later immediately. If upgrading is not possible, consider using the legacy executor as a temporary workaround or adjust COMPUTED field permissions to restrict access to hidden fields.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109335. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart