CVE-2026-63748

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0

Description Authenticated users with UPDATE access can read field values that are hidden by field-level SELECT permissions. This occurs because arithmetic operators and the extend operation embed raw operand values within error messages. Since UPDATE permission checks are evaluated against the unreduced document, an attacker can trigger an incompatible operation on a hidden field to reveal its value in the resulting error response. This allows the disclosure of one field per operation across any record the user has permission to update.

Recommendations Update to version 3.1.0 or later. As a temporary workaround, do not grant UPDATE permission on records where field-level SELECT permissions are intended to hide values from the same user.