CVE-2026-109341 in SurrealDB
Summary
by MITRE • 10/12/2026
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into readable destinations, or abuse test mismatch errors as a disclosure oracle.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
SurrealDB versions prior to 3.3.0 contain a critical authorization bypass vulnerability that undermines the integrity of field-level access controls within its document storage model. This flaw specifically affects users who possess write permissions at the table level but are restricted from reading certain sensitive fields via SELECT statements. The core technical issue stems from how the database engine processes JSON Patch operations, particularly when resolving pointers against unreduced records during update transactions. Instead of strictly adhering to the access control policies defined for read operations, the system allows these patch operations to interact with data structures in a manner that exposes restricted information. This represents a significant deviation from the principle of least privilege, as write capabilities are inadvertently leveraged to achieve unauthorized read access.
The exploitation mechanism relies heavily on the behavior of JSON Patch copy and move operations. An attacker with table-level write permissions can construct specific PATCH requests designed to target hidden or protected fields within existing records. By using a copy operation, an adversary can duplicate data from restricted columns into other fields that are not subject to such stringent access controls. Once this data is copied into a readable destination field, the attacker can subsequently query those accessible fields to retrieve the originally secret information. This technique effectively circumvents the SELECT restrictions because the final read operation targets a field with lower security clearance, even though the source of the data was highly restricted. The vulnerability exploits the gap between write-time processing and read-time enforcement, allowing data exfiltration through indirect means rather than direct query attempts on protected columns.
In addition to copy operations, attackers can abuse test mismatch errors as an information disclosure oracle. When a JSON Patch operation is applied against a record where certain fields are inaccessible or do not exist in the expected format due to access restrictions, the database may return specific error messages related to these mismatches. By carefully crafting requests and analyzing the resulting error responses, an attacker can infer the existence and potentially the content of restricted data. This side-channel approach allows for blind exploitation scenarios where direct retrieval is impossible but logical deduction based on system feedback reveals sensitive details. The combination of structural manipulation via copy/move operations and informational leakage through error messages creates a robust attack vector that compromises confidentiality without requiring elevated privileges beyond basic table write access.
From an industry standard perspective, this vulnerability aligns with CWE-269 Improper Privilege Management, as it involves the abuse of lower-level permissions to gain higher-level data access. It also relates closely to CWE-862 Missing Authorization, specifically in the context of field-level or object-level access control failures where the system fails to enforce restrictions consistently across different operation types. In terms of the MITRE ATT&CK framework, this behavior is indicative of T1005 Data from Local System which describes techniques for collecting data directly from a compromised local source, and potentially T1213 Data from Information Repositories if viewed as an abuse of database query mechanisms to extract unauthorized information. The vulnerability highlights the complexity of implementing fine-grained access controls in NoSQL databases that support complex document manipulation operations like JSON Patching.
To mitigate this risk, organizations running SurrealDB must upgrade immediately to version 3.3.0 or later where these authorization checks have been hardened. Until an upgrade is feasible, administrators should strictly limit table-level write permissions to only those users and applications with a verified business need for such access. Implementing robust input validation on all PATCH requests can help reduce the attack surface by filtering out malformed or suspiciously structured JSON Patch documents before they reach the database engine. Additionally, monitoring logs for unusual patterns of error responses following update operations may aid in detecting active exploitation attempts. It is crucial to review and minimize the scope of write permissions across the database environment, ensuring that no single user account has excessive privileges that could be leveraged for lateral data movement or information disclosure through the mechanisms described above.