3329 matches found
CVE-2026-109337 SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are...
CVE-2026-109337
SurrealDB versions before 3.3.0 are vulnerable to an authorization bypass involving field-level SELECT permissions. This vulnerability allows record users to infer hidden field values by using LIVE SELECT WHERE predicates over $before or $after . By crafting and repeating specific predicates, an ...
CVE-2026-109337 SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are...
CVE-2026-109335 SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN...
CVE-2026-109336 SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive...
CVE-2026-109336
SurrealDB versions prior to 3.3.0 are vulnerable to an authorization bypass where record users can access fields hidden by field-level SELECT permissions . The root cause is a flaw in LIVE SELECT projections , allowing attackers to project restricted fields from unreduced $after or $before parame...
CVE-2026-109335 SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN...
CVE-2026-109335
SurrealDB versions 3.0.0 before 3.3.0 are vulnerable to an information disclosure flaw involving COMPUTED fields . The root cause allows users to bypass field-level SELECT permissions by accessing records where readable COMPUTED fields are derived from hidden fields. Additionally, attackers can u...
CVE-2026-109335
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN...
CVE-2026-109335 SurrealDB 3.0.0 before 3.3.0 Information Disclosure via COMPUTED Fields
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN...
CVE-2026-109336 SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive...
EUVD-2026-97638
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive...
CVE-2026-109336
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive...
PT-2026-110752
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN...
PT-2026-110753
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive...
PT-2026-110754
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are...
CVE-2026-109336: Incorrect Authorization
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive...
CVE-2026-109335: Exposure of Sensitive Information to an Unauthorized Actor
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN...
CVE-2026-109337: Observable Discrepancy
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are...
