Duplicate Advisory: SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field

SurrealDB before version 3.1.5 fails to apply field-level SELECT permissions to ORDER BY clauses in queries. Authenticated users can exploit this by issuing ORDER BY queries on indexed restricted fields to leak the relative sort order of those hidden values across records. Although the restricted field values are returned as null, the ordering information is exposed, potentially revealing sensitive data ordering.

The vulnerability allows an authenticated user to infer the relative ordering of restricted field values that should be hidden by SELECT permissions. This results in a confidentiality breach of data ordering information, though the actual field values remain undisclosed. There is no impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links are provided and no official fix is mentioned, users should monitor vendor communications for updates. Until a fix is available, avoid relying on field-level SELECT permissions to protect sensitive ordering information or restrict authenticated user query capabilities accordingly.