Authorization Bypass Vulnerability in SurrealDB by SurrealDB, Inc.

CVE-2026-109341

What is CVE-2026-109341?

SurrealDB versions before 3.3.0 contain a vulnerability that allows users with table-level write permissions to exploit the JSON Patch functionality. This exploitation enables attackers to access SELECT-restricted fields by utilizing PATCH copy or move operations, which can incorrectly resolve fields against the unreduced record. By doing so, malicious actors can leak sensitive information, leveraging test mismatch errors as a means to disclose hidden fields. Proper mitigation involves ensuring users have restricted permissions and updating to the latest version.

References