GHSA-6g9v-7gq3-p2c6: SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
(updated )
A record user with UPDATE access could read field values that field-level SELECT permissions hid from them. Arithmetic operators and extend embedded the raw operand into their error messages, and UPDATE permission checks evaluate against the unreduced document — so triggering such an error against a hidden field returned its value in the resulting error.
References
- github.com/advisories/GHSA-6g9v-7gq3-p2c6
- github.com/surrealdb/surrealdb/commit/0aaa332c79195e4c40275eb5224aed3d52f5cf90
- github.com/surrealdb/surrealdb/security/advisories/GHSA-6g9v-7gq3-p2c6
- nvd.nist.gov/vuln/detail/CVE-2026-63748
- www.vulncheck.com/advisories/surrealdb-before-information-disclosure-via-error-messages
Code Behaviors & Features
Detect and mitigate GHSA-6g9v-7gq3-p2c6 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →