CVE-2026-63309 Overview
CVE-2026-63309 is an information disclosure vulnerability in SurrealDB versions before 3.1.5. The database engine fails to apply field-level SELECT permissions to ORDER BY clauses. Authenticated users can issue ORDER BY queries against indexed but restricted fields to recover the relative ordering of hidden values across records. The field itself continues to return null as intended, yet the sort order leaks the underlying data ranking. This flaw maps to CWE-863: Incorrect Authorization and was disclosed through the GitHub Security Advisory GHSA-h4h3-3rfj-x6fq.
Critical Impact
Authenticated attackers can infer the ordering of restricted field values such as salaries, scores, or timestamps, enabling reconstruction of sensitive data despite SELECT permission enforcement on field reads.
Affected Products
- SurrealDB versions prior to 3.1.5
- Deployments relying on field-level SELECT permissions for confidentiality
- Any SurrealDB instance exposing indexed restricted fields to authenticated users
Discovery Timeline
- 2026-07-17 - CVE-2026-63309 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-63309
Vulnerability Analysis
SurrealDB enforces field-level SELECT permissions when returning record data, replacing restricted values with null in query results. However, the query planner does not evaluate these permissions when the same fields appear in an ORDER BY clause. The sort operation runs against the raw indexed values rather than the permission-filtered projection.
An authenticated user with any level of query access can request records sorted by a restricted field. The returned rows appear with null in the restricted column, but the row order reflects the true ranking of the hidden values. By pairing ORDER BY with ASC, DESC, and range filters, an attacker can perform binary-search style probing to recover exact values across the dataset.
The issue falls under authorization logic errors described in CWE-863. The VulnCheck advisory documents the disclosure channel in detail.
Root Cause
The permission model is applied at the projection stage of query execution, not at the sort stage. When ORDER BY references a field, SurrealDB uses index metadata or raw column values to compute the sort order before permission redaction runs. The two stages operate on inconsistent views of the data, breaking the confidentiality guarantee that field-level SELECT rules are intended to provide.
Attack Vector
Exploitation requires authenticated access to the SurrealDB endpoint over the network. The attacker issues repeated SELECT queries with ORDER BY clauses targeting a restricted field, optionally combined with LIMIT, START, and WHERE filters. Each response reveals the relative rank of records. Iterative queries with narrowing predicates allow the attacker to recover discrete values without ever reading the restricted field directly.
No verified public exploit code is available. Refer to the SurrealDB v3.1.5 release notes and the linked security advisory for further technical detail on the query paths involved.
Detection Methods for CVE-2026-63309
Indicators of Compromise
- Query logs showing repeated SELECT statements with ORDER BY clauses referencing fields protected by field-level SELECT permissions.
- High-frequency queries from a single authenticated principal that vary only in LIMIT, START, or WHERE predicates on a restricted field.
- Access patterns where a low-privilege account systematically enumerates records sorted by sensitive columns.
Detection Strategies
- Enable SurrealDB query logging and audit any ORDER BY referencing fields listed in field-level PERMISSIONS rules.
- Correlate authenticated session activity with permission definitions to flag mismatches between what a user can read and what they can sort by.
- Alert on iterative query sequences that resemble binary-search enumeration against the same field.
Monitoring Recommendations
- Forward SurrealDB logs to a centralized SIEM and build detections for ORDER BY against restricted fields.
- Track query volume per authenticated user and threshold on anomalous spikes targeting sensitive collections.
- Review roles and permission grants regularly to ensure no unintended principals retain query access to tables with restricted fields.
How to Mitigate CVE-2026-63309
Immediate Actions Required
- Upgrade SurrealDB to version 3.1.5 or later using the official v3.1.5 release.
- Audit existing schemas for tables that rely on field-level SELECT permissions to protect sensitive columns.
- Rotate or reassess any data whose ordering may have been inferred from pre-patch queries.
Patch Information
SurrealDB 3.1.5 corrects the permission enforcement path so that ORDER BY clauses honor field-level SELECT rules. Details are documented in the GitHub Security Advisory GHSA-h4h3-3rfj-x6fq.
Workarounds
- Restrict SELECT access at the record or table level rather than the field level for highly sensitive columns until patched.
- Remove indexes on restricted fields where feasible to reduce the efficiency of ordering-based inference.
- Limit database access to trusted service accounts and enforce least privilege on query roles.
# Verify installed SurrealDB version and upgrade
surreal version
# Upgrade to a fixed release (3.1.5 or later)
curl -sSf https://install.surrealdb.com | sh -s -- --version v3.1.5
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
