CVE-2026-109337: SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause

Q: Which users could exploit this issue?

Record users who can issue LIVE SELECT queries are the relevant threat population. The issue concerns users who are subject to field-level SELECT restrictions but can use WHERE predicates involving $before or $after.

Q: What does an attacker need to observe to extract information?

The attacker needs to craft repeated LIVE SELECT WHERE predicates and determine whether notifications are delivered for CREATE, UPDATE, or DELETE events. Notification delivery can be used to confirm or progressively narrow hidden field values.

Q: How can I determine whether an installation is affected?

SurrealDB versions before 3.3.0 are affected. Exposure is relevant where field-level SELECT permissions are used and record users can create LIVE SELECT predicates over $before or $after.

Published Oct 12, 2026

Updated

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.

Affected Software

1 affected component

SurrealDB SurrealDB<3.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SurrealDB to a version that resolves this vulnerability.
Fixed in 3.3.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users could exploit this issue?

Record users who can issue LIVE SELECT queries are the relevant threat population. The issue concerns users who are subject to field-level SELECT restrictions but can use WHERE predicates involving $before or $after.

What does an attacker need to observe to extract information?

The attacker needs to craft repeated LIVE SELECT WHERE predicates and determine whether notifications are delivered for CREATE, UPDATE, or DELETE events. Notification delivery can be used to confirm or progressively narrow hidden field values.

How can I determine whether an installation is affected?

SurrealDB versions before 3.3.0 are affected. Exposure is relevant where field-level SELECT permissions are used and record users can create LIVE SELECT predicates over $before or $after.

CVE-2026-109337: SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE Clause

Affected Software

Remediation

Event History

Frequently Asked Questions

Which users could exploit this issue?

What does an attacker need to observe to extract information?

How can I determine whether an installation is affected?

Company

Resources

Contact

Frequently Asked Questions

Which users could exploit this issue?

What does an attacker need to observe to extract information?

How can I determine whether an installation is affected?