Authorization Bypass Vulnerability in SurrealDB

CVE-2026-109337

What is CVE-2026-109337?

SurrealDB versions before 3.3.0 contain an authorization bypass vulnerability that permits record users to infer hidden field values protected by field-level SELECT permissions. By exploiting LIVE SELECT WHERE predicates involving $before or $after, attackers can systematically create and observe predicates, allowing them to confirm or refine access to restricted field values based on the notifications received from CREATE, UPDATE, or DELETE operations.

References