Information Disclosure Vulnerability in SurrealDB by SurrealDB

CVE-2026-109335

What is CVE-2026-109335?

SurrealDB versions prior to 3.3.0 are susceptible to an information disclosure vulnerability that enables users with record access to retrieve data obscured by field-level SELECT permissions. By leveraging COMPUTED fields, an attacker can gain access to hidden values or expose sensitive data through the use of write RETURN clauses combined with $before/$after. This flaw underscores the importance of reviewing and securing database permissions to prevent unauthorized data exposure.

References