Description
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMPUTED fields derive from hidden fields, or use write RETURN clauses with $before/$after to expose hidden values.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
surrealdb surrealdb
Default version status: unaffected
3.0.0 to < 3.3.0affected3.3.0unaffected
pkg:cargo/surrealdb