CVE-2026-109336
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Oct 12, 2026
Vendor
unknown
Description
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive exact stored values in CREATE, UPDATE, and DELETE notifications.