CVE-2026-109337 in SurrealDB
Summary
by MITRE • 10/12/2026
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
SurrealDB versions prior to 3.3.0 contain a critical authorization bypass vulnerability that undermines the integrity of field-level security controls. This flaw specifically affects users authenticated as record users who are subject to restrictive SELECT permissions on specific fields within database records. The core issue lies in how the system handles LIVE queries, which allow clients to subscribe to real-time changes in data. While standard SELECT operations correctly enforce access control by hiding restricted fields from unauthorized users, the implementation of LIVE SELECT statements fails to apply these same restrictions consistently when evaluating WHERE predicates against historical state variables such as $before and $after. These variables represent the state of a record before or after an operation like CREATE, UPDATE, or DELETE. By leveraging this inconsistency, attackers can bypass field-level permissions that are otherwise strictly enforced during standard data retrieval operations.
The technical mechanism behind this vulnerability relies on side-channel inference through notification delivery patterns rather than direct data exfiltration. When a user with limited SELECT privileges attempts to query restricted fields using LIVE SELECT WHERE predicates over $before or $after, the system does not filter out these fields in the predicate evaluation context as it should. Instead of returning an error or empty result set for unauthorized access, the database processes the query and delivers notifications based on whether the condition matches existing data changes. An attacker can craft a series of targeted queries with specific predicates designed to match potential values of hidden fields. By observing which CREATE, UPDATE, or DELETE events trigger notifications, the attacker can confirm if their guessed value exists in the restricted field. This process allows for iterative narrowing down of possible values through repeated observations, effectively reconstructing sensitive data that should remain inaccessible under normal access control policies.
The operational impact of this vulnerability is significant, particularly in environments where SurrealDB handles sensitive information such as personally identifiable information, financial records, or proprietary business logic. Since the attack does not require privilege escalation to an admin role but only valid record-level authentication, it poses a risk to any multi-tenant application relying on fine-grained access control. The ability to infer hidden field values compromises data confidentiality and violates the principle of least privilege. Furthermore, because this is an inference-based attack, it may evade traditional intrusion detection systems that look for explicit unauthorized read attempts or SQL injection patterns. The attacker gains a persistent method to extract sensitive information without triggering standard security alerts associated with direct permission violations.
To mitigate this vulnerability, organizations must immediately upgrade SurrealDB to version 3.3.0 or later, where the logic for LIVE SELECT predicates has been corrected to respect field-level permissions consistently across all query contexts. Until an upgrade is feasible, administrators should consider restricting access to live queries for users who do not require real-time data synchronization features. Additionally, implementing strict rate limiting on database connections can help mitigate the effectiveness of iterative inference attacks by slowing down the enumeration process. Security teams should also audit their application logic to ensure that no critical sensitive fields are exposed through any query type without robust validation and authorization checks at the application layer as a defense-in-depth measure.
This vulnerability is classified under CWE-284, which covers Improper Access Control, specifically highlighting failures in enforcing access control restrictions on resources or functions. In terms of offensive security frameworks, this technique aligns with ATT&CK tactic T1078, Valid Accounts, where an attacker uses legitimate credentials to bypass controls, and more specifically relates to data exfiltration techniques that rely on side-channel information leakage rather than direct extraction methods like T1530 Data from Cloud Storage. Understanding these classifications helps in mapping the vulnerability to broader security governance frameworks and ensures that remediation efforts address both the technical flaw and its strategic implications for organizational risk posture.