https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T07:09:48.566806+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-341483 EUVD-2026-341483 2026-10-07T07:09:48.614779+00:00 EUVD-2026-341483 https://cve.radiocsirt.org/vuln/fkie_cve-2026-63748 fkie_cve-2026-63748 2026-10-07T07:09:48.614818+00:00

SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw operand values in error responses, bypassing field-level access controls.

 https://cve.radiocsirt.org/vuln/ghsa-6g9v-7gq3-p2c6 GHSA-6g9v-7gq3-p2c6 — SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages 2026-10-07T07:09:48.614851+00:00

Affected: crates.io: surrealdb

A record user with UPDATE access could read field values that field-level SELECT permissions hid from them. Arithmetic operators and `extend` embedded the raw operand into their error messages, and UPDATE permission checks evaluate against the unreduced document — so triggering such an error against a hidden field returned its value in the resulting error.

### Impact

A record user issues an UPDATE that performs an incompatible operation against a hidden field — e.g. `UPDATE person:me SET probe = email + 1` when `email` is a string — and reads the value from the returned error (`Tried to compute "alice@example.com" + 1 …`). One field per operation, but the attacker can repeat against any field on any record they can UPDATE.

### Patches

A patch has been introduced that replaces the raw operand in every `try_*` operator and in `extend` with the operand's type name (`"string"`, `"int"`, `"array"`, etc.).

- Versions 3.1.0 and later are not affected by this issue.

### Workarounds

Affected users who are unable to update should not grant UPDATE permission on records whose field-level SELECT permissions are expected to hide values from the same caller.