GHSA-9c3h-q3pp-fw5x

Duplicate Advisory: SurrealDB: Field-level SELECT permissions bypassed via graph and reference traversals

Published

2026-07-20

Modified

2026-09-04

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hv6h-hc26-q48p. This link is maintained to preserve external references. ## Original Description SurrealDB versions 3.1.0 before 3.1.5 fail to enforce field-level SELECT permissions when records are accessed through graph-edge or back-reference traversals. Attackers with table-level SELECT access can read field values hidden by field-level permissions by materializing records through graph traversals instead of direct table scans.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-9c3h-q3pp-fw5x