THREAT OPS › Threat News › [GHSA] GHSA-8rw6-p7m8-63jp (medium) — SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
[GHSA] GHSA-8rw6-p7m8-63jp (medium) — SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
GHSA-8rw6-p7m8-63jp Severity: medium CVE: None
SurrealDB: Array element-level (field.*) SELECT permissions leak denied elements to record users
A `SELECT` permission defined on an array element (`DEFINE FIELD field.* … PERMISSIONS FOR select …`) is not enforced correctly for `RECORD` users. Instead of hiding the denied elements, the query leaks a subset of them: a deny-all returns the odd-indexe
Indicators of compromise
- https://surrealdb.com/docs/surrealql/statements/define/fieldurl
- https://surrealdb.com/docs/learn/security/authentication/authenticationurl
- https://surrealdb.com/docs/surrealql/statements/define/tableurl
Original source: https://github.com/advisories/GHSA-8rw6-p7m8-63jp