{"id":"CVE-2026-63309","revision":"7110c1df8fe0450bbf60c75b03e70d15","records":[{"revision":"7110c1df8fe0450bbf60c75b03e70d15","observedAt":"2026-11-04T03:59:20.726+00:00","statement":{"source":"nvd","id":"CVE-2026-63309","aliases":[],"title":"SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted field…","description":"SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records, even though the field itself returns null as intended.","state":0,"publishedAt":"2026-07-17T17:17:17.717+00:00","modifiedAt":"2026-10-24T13:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3,"severity":"MEDIUM"}],"references":["https://github.com/surrealdb/surrealdb/releases/tag/v3.1.5","https://github.com/surrealdb/surrealdb/security/advisories/GHSA-h4h3-3rfj-x6fq","https://www.vulncheck.com/advisories/surrealdb-information-disclosure-via-order-by"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63309","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-863"],"productCriteria":[],"sourceDates":{"published":"2026-07-17T17:17:17.717","lastModified":"2026-10-24T13:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-63309","identifiers":["CVE-2026-63309"]},"retained":false,"historicalAffected":[]}],"coverage":[]}