CVE-2026-121418
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Nov 03, 2026
Vendor
unknown
Description
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors.