CVE-2026-121418

Name of the Vulnerable Software and Affected Versions SurrealDB versions 3.1.0 through 3.2.x

Description An incorrect authorization issue exists where record users can infer values of restricted fields. This occurs because the streaming planner utilizes indexes on fields that have restrictive SELECT permissions. An attacker can exploit this by executing full-text MATCHES, compound B-tree, or HNSW KNN (Hierarchical Navigable Small World, a graph-based index for approximate nearest neighbor search) queries against these restricted fields to determine if records contain specific guessed values or nearest vectors.

Recommendations Update SurrealDB to version 3.3.0 or later.