CVE-2026-109335

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-200

Impact

Authenticated record users can read unauthorized data hidden by field-level SELECT permissions. An attacker needs a valid database account with record access to query COMPUTED fields or trigger write RETURN clauses using $before and $after.

Root cause

Field-level SELECT permissions fail to prevent access to hidden values when referenced inside COMPUTED fields or exposed through write RETURN clauses.

Affected systems

SurrealDB from 3.0.0 before 3.3.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Fix & remediation

Upgrade SurrealDB to version 3.3.0 or higher. If upgrading must wait, audit schemas to remove COMPUTED fields that reference restricted data and restrict user write permissions that allow custom RETURN clauses.

shell

$ surreal version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN clauses with $before/$after to expose hidden values.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109335