EUVD-2026-45215
GHSA-2f98-6626-h2p2
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible, low complexity; authenticated record user required (PR:L); only partial confidentiality via sort-order side channel; no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records, even though the field itself returns null as intended.
AnalysisAI
SurrealDB versions 3.0.0 through 3.1.4 expose a query-planner authorization bypass that allows authenticated record users to infer the relative sort order of field values protected by field-level SELECT permissions. By issuing ORDER BY queries against indexed restricted fields, an attacker with normal table SELECT access can observe that rows are returned in the hidden field's true sorted order even though the field value itself is correctly redacted to null at projection time. No public exploit has been identified at time of analysis, and CISA KEV has not listed this vulnerability; however, the attack surface is inherent to any indexed field protected by field-level permissions in affected versions.
Technical ContextAI
SurrealDB (cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*) is a multi-model database written in Rust that supports fine-grained field-level DEFINE FIELD permissions. The root cause is CWE-863 (Incorrect Authorization): the query planner's index-scan optimization selects a field's B-tree or range index to satisfy an ORDER BY clause and walks index entries in value order before row projection occurs. Field-level SELECT permission checks are applied at projection time - after the sort order has already been encoded into the result row sequence. The guard that blocks restricted fields from the WHERE evaluation path was never extended to the ORDER BY path. This architectural gap means that the index acts as a side channel: the sorted row sequence reveals the hidden field's value ordering even though no value is returned in the payload.
RemediationAI
Upgrade to SurrealDB 3.1.5, which is confirmed as the fixed release per the vendor advisory GHSA-h4h3-3rfj-x6fq and the release page at https://github.com/surrealdb/surrealdb/releases/tag/v3.1.5. The fix applies the field-permission guard to the ORDER BY clause in addition to the WHERE clause and removes the index sort pushdown for hidden fields, sorting after redaction instead. For users unable to upgrade immediately, two workarounds are available with trade-offs: first, set the environment variable SURREAL_PLANNER_STRATEGY=compute-only to force the legacy executor, which sorts after redaction - this eliminates the leak but disables query planner index optimizations and may degrade query performance on large datasets. Second, remove indexes from any field whose values are protected by field-level SELECT permissions, since the leak only occurs when an index covers the restricted field - this is targeted but requires schema changes and sacrifices index-assisted sort performance on those fields.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today