Executive brief
SurrealDB is a multi-model database used for managing structured and unstructured data. A security flaw allowed users with limited access to see the relative order of sensitive data they were supposed to be blocked from viewing. While the actual values remain hidden, an attacker could use the sorting order to guess or narrow down restricted information, potentially compromising data privacy.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in SurrealDB's query planner. When a field is restricted via field-level SELECT permissions but is indexed, the database engine applies the index sort pushdown before the permission-based redaction occurs. An authenticated attacker can issue an ORDER BY query on such a field; although the returned field values are correctly nulled, the records are returned in the actual sorted order of the hidden values. This side-channel allows for the recovery of relative ordering across records and can be used to narrow down exact values if the attacker controls other records in the same table. The issue is fixed in version 3.1.5 by ensuring field-permission guards are applied to ORDER BY clauses.
Affected products
- SurrealDB SurrealDB >= 3.0.0, < 3.1.5
Timeline
- 2026-06-19: patched: Version 3.1.5 released
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE-2026-63309 published