SurrealDB information disclosure via indexed ORDER BY on restricted fields

Executive brief

SurrealDB is a multi-model database used for managing application data. A vulnerability in its query engine allows users to infer the relative order of sensitive data they are not authorized to see. While the actual values remain hidden, an attacker can use the sorting behavior of the database to gain insights into protected information, potentially compromising data confidentiality.

Technical details

A vulnerability exists in the SurrealDB query planner where field-level SELECT permissions are not applied to the ORDER BY clause when an index is present. When a user queries a table and orders by a restricted field, the planner uses the index to sort the results before the field-level redaction occurs. Consequently, while the returned field values are correctly nulled, the records are returned in the actual sorted order of the hidden values. This creates a side-channel oracle allowing an attacker with table-level SELECT access to determine the relative ordering of sensitive data across different records. The issue is fixed in version 3.1.5 by ensuring the query planner applies permission guards to ORDER BY clauses.

Affected products

• SurrealDB SurrealDB >= 3.0.0, < 3.1.5

Timeline

• 2026-06-19: disclosed
• 2026-06-19: advisory
• 2026-06-19: patched: Fixed in version 3.1.5

References

• https://api.github.com/users/geo-chen
• https://github.com/geo-chen
• https://api.github.com/users/geo-chen/gists%7B/gist_id%7D
• https://api.github.com/users/geo-chen/repos
• https://avatars.githubusercontent.com/u/2404584?v=4
• https://api.github.com/users/geo-chen/events%7B/privacy%7D