| Package | Affected versions | Patched versions |
|---|---|---|
| surrealdb | < 3.1.0 | 3.1.0 |
SurrealDB versions before 3.1.0 contain an information disclosure vulnerability where authenticated users with UPDATE access can read field values hidden by field-level SELECT permissions through error messages. Attackers can trigger arithmetic or extend operations on hidden fields to embed raw operand values in error responses, bypassing field-level access controls.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free