SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.
Get the CyboWatch SIEM platform, hosting, and 24×7 SOC analysts. Send an enquiry, or call or email us to get started.