CVE-2026-63742

SurrealDB before 3.1.0 has a field-level SELECT permission bypass in indexed COUNT fast paths. The vulnerability allows attackers to run COUNT queries on indexed fields with restricted access to infer or recover restricted field values through repeated guesses. Affected product: SurrealDB; affect...

CVE-2026-63742

SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries on indexed fields with field-level SELECT restrictions to confirm or recover restricted field values through repeated guesses...