CVE-2026-63309

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 3.1.5

Description Authenticated users can leak the relative ordering of restricted field values because field-level SELECT permissions are not applied to ORDER BY clauses. By issuing ORDER BY queries on indexed restricted fields, an attacker can recover the sort order of hidden values across records, despite the field returning null as intended.

Recommendations Update SurrealDB to version 3.1.5 or later.