Incorrect Authorization in SurrealDB Affects User Data Privacy

CVE-2026-121418

What is CVE-2026-121418?

SurrealDB versions prior to 3.3.0 are affected by an incorrect authorization vulnerability, which allows users to infer restricted field values through the streaming planner. By leveraging indexes associated with fields that have restrictive SELECT permissions, attackers can execute full-text MATCHES, compound B-tree, or HNSW KNN queries on these restricted fields. This can potentially expose sensitive data, thereby compromising user privacy. Proper authorization mechanisms should be implemented to mitigate this risk.

References