CVE-2026-109341: SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations

Q: Who can exploit this issue?

A caller needs table-level write permission. The issue is relevant where that caller is intentionally denied SELECT access to one or more fields in records they can PATCH.

Q: What access is required to disclose restricted data?

The attacker must be able to submit PATCH operations against affected records. They can use copy or move to place a hidden field into a readable destination, or use test-operation mismatch errors as an information-disclosure oracle.

Q: Which deployments are affected?

SurrealDB versions before 3.3.0 are affected when field-level SELECT restrictions coexist with table-level write permission and PATCH access. The provided information does not establish whether this configuration is enabled by default.

Published Oct 12, 2026

Updated

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into readable destinations, or abuse test mismatch errors as a disclosure oracle.

Affected Software

1 affected component

SurrealDB SurrealDB<3.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade SurrealDB to a version that resolves this vulnerability.
Fixed in 3.3.0

Event History

Oct 12, 2026

CVE Published

via MITRE·04:05 PM

Data Sourced

via MITRE·04:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A caller needs table-level write permission. The issue is relevant where that caller is intentionally denied SELECT access to one or more fields in records they can PATCH.

What access is required to disclose restricted data?

The attacker must be able to submit PATCH operations against affected records. They can use copy or move to place a hidden field into a readable destination, or use test-operation mismatch errors as an information-disclosure oracle.

Which deployments are affected?

SurrealDB versions before 3.3.0 are affected when field-level SELECT restrictions coexist with table-level write permission and PATCH access. The provided information does not establish whether this configuration is enabled by default.

CVE-2026-109341: SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What access is required to disclose restricted data?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access is required to disclose restricted data?

Which deployments are affected?