What’s Vulnerable › Vulnerabilities

CVE-2026-109341: SurrealDB before 3.3.0 Field Permission Bypass via PATCH copy/move/test Operations

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-12 · updated 2026-10-26
• Weakness: CWE-200

Description

SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into readable destinations, or abuse test mismatch errors as a disclosure oracle.

Affected products

• surrealdb: before 3.3.0 — fixed in 3.3.0

How to fix

Upgrade to a fixed version: surrealdb 3.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h2c3-549c-gjpr
• https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-field-permission-bypass-via-patch-copy-move-test-operations

Get alerted when CVE-2026-109341 or the next vulnerability affects your stack