{"id":"CVE-2026-63309","state":"PUBLISHED","title":"SurrealDB < 3.1.5 Information Disclosure via ORDER BY","description":"SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records, even though the field itself returns null as intended.","publishedAt":"2026-07-17T16:14:51.248Z","updatedAt":"2026-07-28T01:05:30.275Z","severity":{"score":5.3,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["surrealdb surrealdb"],"affected":[{"vendor":"surrealdb","product":"surrealdb","packageURL":"pkg:cargo/surrealdb","defaultStatus":"unaffected","versions":[{"version":"3.0.0","status":"affected","lessThan":"3.1.5","versionType":"semver"},{"version":"3.1.5","status":"unaffected","versionType":"semver"}],"repo":"https://github.com/surrealdb/surrealdb"}],"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4h3-3rfj-x6fq","https://github.com/surrealdb/surrealdb/releases/tag/v3.1.5","https://www.vulncheck.com/advisories/surrealdb-information-disclosure-via-order-by"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/63xxx/CVE-2026-63309.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-63309","state":"PUBLISHED","datePublished":"2026-07-17T16:14:51.248Z","dateUpdated":"2026-07-28T01:05:30.275Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-07-16T12:13:18.733Z"},"containers":{"cna":{"title":"SurrealDB < 3.1.5 Information Disclosure via ORDER BY","descriptions":[{"lang":"en","value":"SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records, even though the field itself returns null as intended."}],"affected":[{"vendor":"surrealdb","product":"surrealdb","packageURL":"pkg:cargo/surrealdb","defaultStatus":"unaffected","versions":[{"version":"3.0.0","status":"affected","lessThan":"3.1.5","versionType":"semver"},{"version":"3.1.5","status":"unaffected","versionType":"semver"}],"repo":"https://github.com/surrealdb/surrealdb"}],"references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4h3-3rfj-x6fq","name":"GitHub Security Advisory (GHSA-h4h3-3rfj-x6fq)","tags":["vendor-advisory"]},{"url":"https://github.com/surrealdb/surrealdb/releases/tag/v3.1.5","name":"Release Notes","tags":["release-notes"]},{"url":"https://www.vulncheck.com/advisories/surrealdb-information-disclosure-via-order-by","tags":["third-party-advisory"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"LOW","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"MEDIUM","baseScore":5.3,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","version":"3.1","baseSeverity":"MEDIUM","baseScore":4.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","lang":"en","description":"Incorrect Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-07-28T01:05:30.275Z"},"tags":["x_open-source"],"datePublic":"2026-06-19T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*","versionStartIncluding":"3.0.0","versionEndExcluding":"3.1.5"}]}]}],"credits":[{"lang":"en","value":"George Chen","type":"finder"}],"x_generator":{"engine":"vulncheck-endgame"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-07-17T16:40:21.281517Z","id":"CVE-2026-63309","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-17T16:40:41.432Z"}}]}}}