CVE-2026-109337

CVSS 5.3 (medium) · published 2026-10-12

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.

Weakness: CWE-203

Source: NVD CVE-2026-109337

References

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jm88-9wvx-6h4q
• https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-field-permission-bypass-via-live-select-where-clause

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.