GHSA-6g9v-7gq3-p2c6: SurrealDB: Authenticated callers can read fields hidden by field-level SELECT permissions via error messages
(updated )
A record user with UPDATE access could read field values that field-level SELECT permissions hid from them. Arithmetic operators and extend embedded the raw operand into their error messages, and UPDATE permission checks evaluate against the unreduced document — so triggering such an error against a hidden field returned its value in the resulting error.
References
- github.com/advisories/GHSA-6g9v-7gq3-p2c6
- github.com/surrealdb/surrealdb/commit/0aaa332c79195e4c40275eb5224aed3d52f5cf90
- github.com/surrealdb/surrealdb/security/advisories/GHSA-6g9v-7gq3-p2c6
- nvd.nist.gov/vuln/detail/CVE-2026-63748
- www.vulncheck.com/advisories/surrealdb-before-information-disclosure-via-error-messages
Code Behaviors & Features
Detect and mitigate GHSA-6g9v-7gq3-p2c6 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →