CVE-2026-109336 in SurrealDB
Summary
by MITRE • 10/12/2026
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive exact stored values in CREATE, UPDATE, and DELETE notifications.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/12/2026
SurrealDB versions prior to 3.3.0 are affected by a critical authorization bypass vulnerability that undermines the integrity of field-level security controls. This flaw specifically targets the mechanism used for real-time data synchronization via LIVE SELECT queries, which allow clients to subscribe to changes in database records. The core issue lies in how the system handles projections within these live query notifications. While SurrealDB implements granular access control policies that restrict users from viewing specific fields based on their role or permissions, this protection mechanism fails when applied to the internal parameters used for change tracking during CREATE, UPDATE, and DELETE operations.
The technical root cause involves the handling of the $after and $before variables within LIVE SELECT projections. These variables contain snapshots of record data before and after a modification event. Under normal circumstances, if a user lacks permission to view certain fields, those fields should be masked or omitted from any output generated for that user. However, due to an implementation oversight in versions earlier than 3.3.0, the system does not adequately filter these internal variables against field-level permissions before projecting them into the notification payload. An attacker with record-level access can exploit this by crafting a LIVE SELECT query that projects restricted fields from either the $after or $before parameter under an alias. This technique effectively circumvents the permission checks because the filtering logic is bypassed during the projection phase of the live update process.
The operational impact of this vulnerability allows unauthorized users to read sensitive data that should be strictly hidden by field-level SELECT permissions. By receiving exact stored values in notifications triggered by record modifications, an attacker can extract confidential information such as personal identifiable information, financial details, or proprietary business logic without needing elevated privileges beyond basic record access. This represents a significant breach of confidentiality and violates the principle of least privilege. The vulnerability affects all database operations that trigger live updates, meaning any CREATE, UPDATE, or DELETE action performed by an authorized user can inadvertently leak restricted data to unauthorized observers who have subscribed to those changes via LIVE SELECT.
This flaw aligns with CWE-269, Improper Privilege Management, as it allows a lower-privileged actor to access resources reserved for higher-privileged roles through a logic error in the authorization enforcement layer. Furthermore, from an offensive security perspective, this technique can be categorized under ATT&CK T1078, Valid Accounts, specifically within the context of abusing legitimate authentication mechanisms to escalate data access privileges beyond intended boundaries. The vulnerability highlights the complexity of enforcing fine-grained access controls in real-time streaming architectures where state changes are propagated asynchronously.
To mitigate this risk, organizations running SurrealDB must upgrade immediately to version 3.3.0 or later, which includes patches that correctly enforce field-level permissions on $after and $before projections within LIVE SELECT notifications. Until the upgrade is performed, administrators should consider restricting access to live query subscriptions to only those users who absolutely require real-time data synchronization capabilities. Additionally, implementing strict network segmentation for database services can limit the exposure of these endpoints to untrusted networks. Regular audits of field-level permission policies are also recommended to ensure that sensitive fields are correctly identified and protected against such projection-based bypasses in future deployments.