{"action":"Upgrade surrealdb to 3.1.0 or later.","affected":[{"fixed":"3.1.0","introduced":"0"}],"component":"surrealdb","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["3.1.0"],"ghsa_id":"GHSA-c8jx-96c9-8xrp","id":"tcs_01M5KEWS9ZD788WAT0D2EB8CGE","modified_at":"2026-07-01T20:30:08.860446971Z","published_at":"2026-07-01T20:22:06Z","references":["https://osv.dev/vulnerability/GHSA-c8jx-96c9-8xrp","https://github.com/surrealdb/surrealdb/security/advisories/GHSA-c8jx-96c9-8xrp","https://github.com/surrealdb/surrealdb/pull/240","https://github.com/surrealdb/surrealdb/commit/0c6dd021bb55b32a78a553c72bb9c0cdd414825f","https://github.com/surrealdb/surrealdb"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-c8jx-96c9-8xrp","url":"https://osv.dev/vulnerability/GHSA-c8jx-96c9-8xrp"}],"summary":"SurrealDB: Field-level SELECT permissions bypassed via indexed COUNT fast paths"}