CVE-2026-109337
Deferred Deferred - Pending Action

SurrealDB Authorization Bypass via LIVE SELECT Predicates

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109337
EUVD
EUVD-2026-97639

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-203 The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB before version 3.3.0 has an authorization bypass flaw. Users with record access can infer hidden field values by using LIVE SELECT WHERE predicates with $before or $after. Attackers repeatedly craft predicates and observe notification delivery during CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.

Detection Guidance

Detecting this vulnerability requires checking SurrealDB versions before 3.3.0 and monitoring for unusual LIVE SELECT queries with $before or $after predicates. Review database logs for repeated predicate attempts that may infer restricted field values.

Impact Analysis

This vulnerability allows unauthorized users to deduce sensitive data they shouldn't access, potentially leading to data leaks or privacy breaches. It could enable attackers to reconstruct hidden information through repeated queries and observation of system responses.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR and HIPAA by enabling unauthorized access to sensitive information. It undermines principles of least privilege and data minimization, potentially leading to legal penalties and loss of trust.

Mitigation Strategies

Upgrade SurrealDB to version 3.3.0 or later immediately. If upgrading is not possible, restrict access to LIVE SELECT queries and enforce strict field-level permissions to prevent unauthorized data inference.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109337. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart