MEDIUM 5.3 NVD
CVE-2026-121418
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the stream
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors.
References
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x6mm-9295-rvph
- https://www.vulncheck.com/advisories/surrealdb-3.1.0-before-3.3.0-incorrect-authorization-
This medium severity vulnerability with a CVSS score of 5.3 was published on 2026-11-03 via NVD.
vulnfeed aggregates 18261 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.