PT-2026-60807 · Surrealdb · Surrealdb

George Chen · CVE-2026-63309 · Publicado 2026-07-17 · Atualizado 2026-07-17

Mitre

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records, even though the field itself returns null as intended.

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2026-63309

Produtos afetados

Surrealdb

Referências · 4

• https://github.com/surrealdb/surrealdb/releases/tag/v3.1.5 · Nota
• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4h3-3rfj-x6fq · Aviso do Fabricante
• https://vulncheck.com/advisories/surrealdb-information-disclosure-via-order-by · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63309 · Nota de Segurança