Vulnerabilities

Security fix · CVE-2026-63742

SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths

Published Jul 1, 2026 · catalog updated Nov 4, 2026 · SurrealDB: Field-level SELECT permissions

Last checked Nov 5, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-63742. EPSS is 0.29%. Act only if a listed version of SurrealDB: Field-level SELECT permissions is installed.

Severity

Medium4.3

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.29%

Remediation

Advisory link

Affected products

crates.io surrealdb

A record user could learn the value of a hidden field by counting how many records match a guess. When hides a field's contents from a caller, and that field is indexed, running returned a count greater than zero whenever a record actually had that value — even though the caller was never allowed to read the field directly. The query planner used an indexed-COUNT shortcut ( , , or the legacy / paths) that counts matching index entries and skips the permission check that would normally hide the value. The same query with correctly returned , confirming the gap. By repeating the count query with different guesses, an attacker can confirm or recover the contents of any restricted field they could not read through a normal . ### Impact What an attacker **can** do: - Confirm or recover values of a field protected by field-level SELECT permissions on any table they hold table-level SELECT on, provided the field is indexed. - Repeat the query with different guesses to read restricted field contents one value at a time. What it **can't** do: - Read fields that are not indexed (the shortcut only fires when an index covers the predicate column). - Cross table, database or namespace isolation boundaries. - Modify data, escalate privileges, or affect availability. ### Patches The legacy planner ( ) and the streaming planner ( ) now both refuse the indexed fast path when the WHERE / ORDER tree references a field governed by a non- SELECT permission: - skips any B-tree / unique index whose columns are governed by such a permission. - A new flag is propagated; refuses a dedicated when set. - The streaming planner adds , a visitor that matches each idiom against the table's field-permission prefixes (loaded via the plan-time txn), and gates emission on it. - The fast paths are preserved for root / owner sessions via . Versions 3.1.0 and later are not affected. ### Workarounds Users unable to patch are advised to consider the following workarounds: - Avoid on fields whose values are