Lucene search
+L

603 matches found

Github Security Blog
Github Security Blog
added 2026/07/01 8:22 p.m.19 views

SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths

A record user could learn the value of a hidden field by counting how many records match a guess. When DEFINE FIELD ... PERMISSIONS FOR select WHERE ... hides a field's contents from a caller, and that field is indexed, running SELECT count FROM t WHERE hiddenfield = "guess" GROUP ALL returned a...

5.9AI score
SaveExploits0References4Affected Software1
Rows per page
Query Builder