CVE-2026-63309

SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records, even though the field itself returns null as intended.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/surrealdb/surrealdb/releases/tag/v3.1.5
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4h3-3rfj-x6fq
https://www.vulncheck.com/advisories/surrealdb-information-disclosure-via-order-by

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) SurrealDB antes de la versión 3.1.5 falla al aplicar permisos SELECT a nivel de campo a las cláusulas ORDER BY, permitiendo a usuarios autenticados filtrar el orden relativo de los valores de campos restringidos. Los atacantes pueden emitir consultas ORDER BY en campos restringidos indexados para recuperar el orden de clasificación de los valores ocultos entre registros, incluso aunque el propio campo devuelva nulo como se espera.

Information

Published : 2026-07-17 17:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-63309

Mitre link : CVE-2026-63309

CVE.ORG link : CVE-2026-63309

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-63309", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63309", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-17T16:40:21.281517Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/surrealdb/surrealdb", "vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "3.0.0", "lessThan": "3.1.5", "versionType": "semver"}, {"status": "unaffected", "version": "3.1.5", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb", "defaultStatus": "unaffected"}]}], "published": "2026-07-17T17:17:17.717", "references": [{"url": "https://github.com/surrealdb/surrealdb/releases/tag/v3.1.5", "source": "disclosure@vulncheck.com"}, {"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4h3-3rfj-x6fq", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/surrealdb-information-disclosure-via-order-by", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records, even though the field itself returns null as intended."}, {"lang": "es", "value": "SurrealDB antes de la versi\u00f3n 3.1.5 falla al aplicar permisos SELECT a nivel de campo a las cl\u00e1usulas ORDER BY, permitiendo a usuarios autenticados filtrar el orden relativo de los valores de campos restringidos. Los atacantes pueden emitir consultas ORDER BY en campos restringidos indexados para recuperar el orden de clasificaci\u00f3n de los valores ocultos entre registros, incluso aunque el propio campo devuelva nulo como se espera."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "disclosure@vulncheck.com"}