GHSA-8RW6-P7M8-63JP: Array Element-Level SELECT Permissions Leak in SurrealDB
Vulnerability ID: GHSA-8RW6-P7M8-63JP
CVSS Score: 6.5
Published: 2026-08-14
SurrealDB versions supporting element-level SELECT permissions on arrays are vulnerable to a logical authorization bypass. Due to an index-shifting error during array filtration, restricted elements can skip permission checks and leak to unauthorized record users.
TL;DR
An index-shifting flaw during array reduction allows restricted database elements to bypass SELECT permissions, leading to unauthorized data disclosure.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-285 / CWE-670
- Attack Vector: Network
- CVSS v3.1: 6.5 (Medium)
- Exploit Status: PoC Available
- Impact: Partial Confidentiality Bypass
- Remediation Status: Official Patch Available
Affected Systems
- SurrealDB Core Database Engine
-
SurrealDB: Prior to fix commit 8f89b260bb9692e5b0d58930793d482a8207eedc (Fixed in:
Commit 8f89b260bb9692e5b0d58930793d482a8207eedc)
Code Analysis
Commit: 8f89b26
Fix array element select permissions leak
Mitigation Strategies
- Upgrade SurrealDB to a patched release incorporating reverse-iteration filtering
- Avoid using wildcard element-level permissions on array fields in untrusted environments
- Normalize schemas to store sensitive array items in distinct tables with row-level security
- Implement application-level filtering of query results as an intermediate workaround
Remediation Steps:
- Identify tables using DEFINE FIELD OVERWRITE on wildcard array paths (e.g., items[*])
- Upgrade all SurrealDB server binaries to a version containing commit 8f89b260bb9692e5b0d58930793d482a8207eedc
- Verify the patch by running the reproduction test scripts provided in the official advisory
- Monitor database access logs for unexpected read patterns on tables containing arrays
References
Read the full report for GHSA-8RW6-P7M8-63JP on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)