CVE-2026-63751

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.0

Description Authenticated users can bypass field-level permissions during JSON Patch operations using the UPDATE ... PATCH statement or the db.patch() function. By utilizing a copy or move operation with an empty from pointer, an attacker can duplicate all fields of a record—including those restricted by field-level SELECT permissions—into a destination field of their choice. Because the permission filter only hides original protected field names and not the new destination fields, the protected values are returned to the caller. This issue allows the unauthorized reading of any field within a single targeted record.

Recommendations Update to version 3.1.0 or later. Restrict the use of UPDATE ... PATCH to users who already possess SELECT permissions for all fields of the target record. Replace the mutation with an explicit SET or MERGE clause to eliminate the JSON Patch attack surface.