CVE-2026-109337
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Oct 12, 2026
Vendor
unknown
Description
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.