CVE-2026-109336

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-863

Impact

Authenticated record users can read unauthorized, restricted fields by projecting them via LIVE SELECT notifications. Attackers only need basic record-level account access to query the database.

Root cause

LIVE SELECT projections fail to enforce field-level SELECT permissions when querying unreduced $before and $after parameters under an alias.

Affected systems

SurrealDB before 3.3.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade SurrealDB to version 3.3.0 or later. If you cannot upgrade immediately, restrict LIVE SELECT permissions or revoke access to tables relying on field-level SELECT permissions.

shell

$ surreal version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive exact stored values in CREATE, UPDATE, and DELETE notifications.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109336