{"items":[{"id":"NVI-00014159","kind":"vulnerability","title":"SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected.","NVD lastModified does not establish freshness of every associated CPE record."],"lifecycle":"active","identifiers":["GHSA-fpxg-5xmv-922m","CVE-2026-63751"],"plain_summary":"GitHub lists this reviewed advisory for surrealdb. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-353d9b85787656a321fe0c1378e3bd37"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-04T20:09:04.000Z","value":"4.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5296a7ba6a3de29bad612caa8e306b1a"},{"kind":"CVSS","as_of":"2026-07-22T15:39:37.620Z","value":"4.3 MEDIUM (3.1)","meaning":"disclosure@vulncheck.com severity; no combined Null risk score.","source_id":"sr-353d9b85787656a321fe0c1378e3bd37"},{"kind":"CVSS","as_of":"2026-07-22T15:39:37.620Z","value":"5.3 MEDIUM (4.0)","meaning":"disclosure@vulncheck.com severity; no combined Null risk score.","source_id":"sr-353d9b85787656a321fe0c1378e3bd37"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5296a7ba6a3de29bad612caa8e306b1a","url":"https://github.com/advisories/GHSA-fpxg-5xmv-922m","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fpxg-5xmv-922m","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:20:52.377Z"},{"id":"sr-353d9b85787656a321fe0c1378e3bd37","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63751","basis":"official_catalog","notes":"This product uses data from the NVD API but is not endorsed or certified by the NVD.","title":"CVE-2026-63751","publisher":"NIST National Vulnerability Database","observed_at":"2026-11-08T15:07:30.585Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5296a7ba6a3de29bad612caa8e306b1a"],"technology":"surrealdb","known_exclusions":[],"conditions_summary":"SurrealDB lets callers modify records using JSON Patch operations via the `UPDATE … PATCH` statement (and SDK equivalents such as `db.patch()`). One of those operations is `copy`, which duplicates one field's value into another field of the same record. A `PATCH` with an empty `from` — for example, `UPDATE thing:1 PATCH [{ op: 'copy', from: '', path: '/leak' }]` — was treated as \"copy the entire record\" and duplicated every field, including fields the caller has no permission to read, into the destination field the caller chose. The permission filter that hides protected field values from the response only knew to hide the *original* protected field names, not the new destinations, so the protected values were returned to the caller intact under the new field name.\n\n### Impact\n\nAn authenticated user with permission to issue `UPDATE … PATCH` against a record could read the values of any field on that record, regardless of field-level `PERMISSIONS FOR select` restrictions. The leak is confidentiality-only, and bounded to the fields of the single record the caller targets per PATCH request — it does not expose other records on the same table or any data outside that record's scope.\n\n#","public_affected_ranges":["< 3.1.0"]}],"null_published_at":"2026-11-08T19:53:44.048Z","source_updated_at":"2026-09-04T20:09:04.000Z","source_disclosed_at":"2026-07-01T20:18:06.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-11-02T02:20:52.377Z"},{"id":"NVI-00014159","kind":"vulnerability","title":"SurrealDB has bypass of field-level SELECT permissions through JSON Patch `copy` and `move` with empty `from`","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fpxg-5xmv-922m","CVE-2026-63751"],"plain_summary":"GitHub lists this reviewed advisory for surrealdb. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-5296a7ba6a3de29bad612caa8e306b1a"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-04T20:09:04.000Z","value":"4.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-5296a7ba6a3de29bad612caa8e306b1a"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-5296a7ba6a3de29bad612caa8e306b1a","url":"https://github.com/advisories/GHSA-fpxg-5xmv-922m","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fpxg-5xmv-922m","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:20:52.377Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-5296a7ba6a3de29bad612caa8e306b1a"],"technology":"surrealdb","known_exclusions":[],"conditions_summary":"SurrealDB lets callers modify records using JSON Patch operations via the `UPDATE … PATCH` statement (and SDK equivalents such as `db.patch()`). One of those operations is `copy`, which duplicates one field's value into another field of the same record. A `PATCH` with an empty `from` — for example, `UPDATE thing:1 PATCH [{ op: 'copy', from: '', path: '/leak' }]` — was treated as \"copy the entire record\" and duplicated every field, including fields the caller has no permission to read, into the destination field the caller chose. The permission filter that hides protected field values from the response only knew to hide the *original* protected field names, not the new destinations, so the protected values were returned to the caller intact under the new field name.\n\n### Impact\n\nAn authenticated user with permission to issue `UPDATE … PATCH` against a record could read the values of any field on that record, regardless of field-level `PERMISSIONS FOR select` restrictions. The leak is confidentiality-only, and bounded to the fields of the single record the caller targets per PATCH request — it does not expose other records on the same table or any data outside that record's scope.\n\n#","public_affected_ranges":["< 3.1.0"]}],"null_published_at":"2026-11-02T10:00:37.215Z","source_updated_at":"2026-09-04T20:09:04.000Z","source_disclosed_at":"2026-07-01T20:18:06.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:20:52.377Z"}],"next_cursor":null,"snapshot_revision":"42594"}