CVE-2026-121418

SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW K...

CVE-2026-121418

SurrealDB versions 3.1.0 before 3.3.0 are vulnerable to an incorrect authorization vulnerability in the streaming index planner . The issue allows users to infer restricted field values because the planner utilizes indexes on fields that have restrictive SELECT permissions . Specifically, an atta...

CVE-2026-121418 SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner

SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW K...

EUVD-2026-115950

SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW K...

CVE-2026-121418: surrealdb: SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer…

SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW K...