EUVD-2026-45913

SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries on indexed fields with field-level SELECT restrictions to confirm or recover restricted field values through repeated guesses...

SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths

A record user could learn the value of a hidden field by counting how many records match a guess. When DEFINE FIELD ... PERMISSIONS FOR select WHERE ... hides a field's contents from a caller, and that field is indexed, running SELECT count FROM t WHERE hiddenfield = "guess" GROUP ALL returned a...