PT-2026-60807 · Surrealdb · Surrealdb

George Chen · CVE-2026-63309 · Published 2026-07-17 · Updated 2026-07-17

Mitre

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records, even though the field itself returns null as intended.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-63309

Affected Products

Surrealdb

References · 4

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4h3-3rfj-x6fq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-63309 · Security Note
• https://github.com/surrealdb/surrealdb/releases/tag/v3.1.5 · Note
• https://vulncheck.com/advisories/surrealdb-information-disclosure-via-order-by · Note