CVE-2026-109337

4.3Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-203

Impact

Authenticated record users can infer hidden, restricted field values by observing LIVE SELECT notifications. They need an active account with permissions to establish LIVE queries on the database.

Root cause

WHERE predicates over $before or $after in LIVE SELECT statements fail to enforce field-level SELECT permissions during change evaluation.

Affected systems

SurrealDB versions before 3.3.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade SurrealDB to version 3.3.0 or later. If patching immediately is not possible, restrict or disable LIVE SELECT query privileges for untrusted record-level users.

shell

$ surreal version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109337