GHSA-8RW6-P7M8-63JP SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users

A SELECT permission defined on an array element DEFINE FIELD field. … PERMISSIONS FOR select … is not enforced correctly for RECORD users. Instead of hiding the denied elements, the query leaks a subset of them: a deny-all returns the odd-indexed elements, and a per-element predicate keeps and...