CVE-2026-109336: SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after

Q: Who can exploit this issue?

An authenticated record user with permission to use LIVE SELECT against affected data can exploit it. The attacker needs to be able to create a projection that aliases restricted fields from the $after or $before parameters.

Q: What data can be exposed through the bypass?

Fields hidden by field-level SELECT permissions can be disclosed with their exact stored values. The exposure occurs in CREATE, UPDATE, and DELETE notifications delivered by LIVE SELECT.

Q: Which configurations are affected?

Affected deployments are those using field-level SELECT permissions together with LIVE SELECT. The issue applies to SurrealDB versions before 3.3.0.

Q: What should be done if an immediate upgrade is not possible?

Restrict untrusted record users from creating or using LIVE SELECT subscriptions where field-level SELECT restrictions protect sensitive fields. Review existing LIVE SELECT projections for use of $after or $before, especially when values are aliased.

Published Oct 12, 2026

Updated

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive exact stored values in CREATE, UPDATE, and DELETE notifications.

Affected Software

1 affected component

SurrealDB SurrealDB<3.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SurrealDB to a version that resolves this vulnerability.
Fixed in 3.3.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated record user with permission to use LIVE SELECT against affected data can exploit it. The attacker needs to be able to create a projection that aliases restricted fields from the $after or $before parameters.

What data can be exposed through the bypass?

Fields hidden by field-level SELECT permissions can be disclosed with their exact stored values. The exposure occurs in CREATE, UPDATE, and DELETE notifications delivered by LIVE SELECT.

Which configurations are affected?

Affected deployments are those using field-level SELECT permissions together with LIVE SELECT. The issue applies to SurrealDB versions before 3.3.0.

What should be done if an immediate upgrade is not possible?

Restrict untrusted record users from creating or using LIVE SELECT subscriptions where field-level SELECT restrictions protect sensitive fields. Review existing LIVE SELECT projections for use of $after or $before, especially when values are aliased.

CVE-2026-109336: SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What data can be exposed through the bypass?

Which configurations are affected?

What should be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What data can be exposed through the bypass?

Which configurations are affected?

What should be done if an immediate upgrade is not possible?