CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 3.1.5 are vulnerable due to inadequate enforcement of field-level SELECT permissions in ORDER BY clauses, enabling authenticated users to infer the ordering of restricted field values. This flaw allows attackers to exploit ORDER BY queries on indexed restricted fields, potentially exposing sensitive data through the relative sorting of values that should remain hidden. Organizations using SurrealDB should prioritize patching to mitigate the risk of data leakage and unauthorized information disclosure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB before 3.1.5 fail to apply field-level SELECT permissions to ORDER BY clauses, allowing authenticated users to leak the relative ordering of restricted field values. Attackers can issue ORDER BY queries on indexed restricted fields to recover the hidden values' sort order across records, even though the field itself returns null as intended.