CVE-2026-63742
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Jul 20, 2026
Vendor
unknown
Description
SurrealDB versions before 3.1.0 contain a field-level SELECT permission bypass vulnerability in indexed COUNT fast paths. Attackers can execute COUNT queries on indexed fields with field-level SELECT restrictions to confirm or recover restricted field values through repeated guesses.