GHSA-8RW6-P7M8-63JP: Array Element-Level SELECT Permissions Leak in SurrealDB

Vulnerability ID: GHSA-8RW6-P7M8-63JP
CVSS Score: 6.5
Published: 2026-08-14

SurrealDB versions supporting element-level SELECT permissions on arrays are vulnerable to a logical authorization bypass. Due to an index-shifting error during array filtration, restricted elements can skip permission checks and leak to unauthorized record users.

TL;DR

An index-shifting flaw during array reduction allows restricted database elements to bypass SELECT permissions, leading to unauthorized data disclosure.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-285 / CWE-670
Attack Vector: Network
CVSS v3.1: 6.5 (Medium)
Exploit Status: PoC Available
Impact: Partial Confidentiality Bypass
Remediation Status: Official Patch Available

Affected Systems

SurrealDB Core Database Engine
SurrealDB: Prior to fix commit 8f89b260bb9692e5b0d58930793d482a8207eedc (Fixed in: Commit 8f89b260bb9692e5b0d58930793d482a8207eedc)

Code Analysis

Commit: 8f89b26

Fix array element select permissions leak

Mitigation Strategies

Upgrade SurrealDB to a patched release incorporating reverse-iteration filtering
Avoid using wildcard element-level permissions on array fields in untrusted environments
Normalize schemas to store sensitive array items in distinct tables with row-level security
Implement application-level filtering of query results as an intermediate workaround

Remediation Steps:

Identify tables using DEFINE FIELD OVERWRITE on wildcard array paths (e.g., items[*])
Upgrade all SurrealDB server binaries to a version containing commit 8f89b260bb9692e5b0d58930793d482a8207eedc
Verify the patch by running the reproduction test scripts provided in the official advisory
Monitor database access logs for unexpected read patterns on tables containing arrays