CVE-2026-109336
Deferred Deferred - Pending Action

SurrealDB Authorization Bypass via LIVE SELECT Projections

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive exact stored values in CREATE, UPDATE, and DELETE notifications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109336
EUVD
EUVD-2026-97638

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB before version 3.3.0 has an authorization bypass flaw. Record users can read fields that should be hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers exploit this by projecting restricted fields using $after or $before parameters under an alias to access exact stored values during CREATE, UPDATE, and DELETE operations.

Detection Guidance

To detect this vulnerability, check if your SurrealDB version is below 3.3.0. Use the command: surrealdb version. If the version is older, the system is vulnerable. Additionally, review LIVE SELECT queries for unauthorized field projections using $before or $after parameters.

Impact Analysis

This vulnerability allows unauthorized users to read sensitive data they should not have access to. It could lead to data leaks, unauthorized access to confidential information, and potential misuse of exposed records during database operations.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized access to protected data. It undermines data protection measures and may lead to legal penalties, loss of trust, and failure to meet regulatory standards for data security and privacy.

Mitigation Strategies

Upgrade SurrealDB to version 3.3.0 or later to address the authorization bypass vulnerability. Review and restrict field-level SELECT permissions to prevent unauthorized data exposure through LIVE SELECT projections.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109336. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart