CyberRota Analysis
AI-GeneratedSurrealDB versions 3.1.0 to 3.1.4 are vulnerable due to inadequate enforcement of field-level SELECT permissions during graph-edge or back-reference traversals. This allows attackers with table-level SELECT access to bypass field-level restrictions and access sensitive data. Organizations using affected versions should prioritize remediation to protect against potential data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph traversals instead of direct table scans.
Related CVEs
Other vulnerabilities affecting the same vendor(s)