CVE-2026-63309 | SurrealDB before 3.1.5 fail to apply field-level SELECT perm… | CVSS 4.3 MEDIUM

Description

SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records, even though the field itself returns null as intended.

Metadata

CVE ID: CVE-2026-63309
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-16 12:13 UTC
Published: 2026-07-17 16:14 UTC
Last updated: 2026-07-17 16:40 UTC
Primary CWE: CWE-863
Incorrect Authorization
Vendor / Product: surrealdb / surrealdb
Sources: cve.org · NVD

Severity & Metrics

4.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
surrealdb	surrealdb	—	3.0.0 < 3.1.5, 3.1.5

Weakness (CWE)

CWE	Source	Description
CWE-863	cna	Incorrect Authorization

CVSS scores (2)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
4.3	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References (3)

GitHub Security Advisory (GHSA-h4h3-3rfj-x6fq) https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4h3-3rfj-x6fq
Release Notes https://github.com/surrealdb/surrealdb/releases/tag/v3.1.5
https://www.vulncheck.com/advisories/surrealdb-information-disclosure-via-order-by