CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 3.1.4 are vulnerable due to improper enforcement of SELECT permissions on array elements, allowing attackers with record scope access to read sensitive data that should be restricted. This vulnerability can lead to unauthorized data exposure, compromising the confidentiality of user records. Organizations using affected versions of SurrealDB should prioritize patching to mitigate the risk of data leaks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB versions before 3.1.4 fail to properly enforce SELECT permissions on array elements (field.*) for record users, leaking denied array elements instead of hiding them. Attackers with record scope access can read array elements that element-level permissions should deny by exploiting incorrect index handling during permission filtering.
Related CVEs
Other vulnerabilities affecting the same vendor(s)