{"answers":{"affected":"2 open source packages ship an affected version, including surrealdb.","exploited":"There is no known exploitation of GHSA-h4h3-3rfj-x6fq in the wild and no public exploit code.","fix":"Upgrade surrealdb to 3.1.5 or later.","what":"GHSA-h4h3-3rfj-x6fq is a vulnerability in surrealdb, published on 19 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-h4h3-3rfj-x6fq and fix it if it is affected.\n\nWhat it is: GHSA-h4h3-3rfj-x6fq is a vulnerability in surrealdb, published on 19 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-h4h3-3rfj-x6fq in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- surrealdb (crates.io): affected from 3.0.0; fixed in 3.1.5\n- surrealdb (crates.io): affected from 3.0.0; fixed in 3.1.5\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-h4h3-3rfj-x6fq/ (Markdown: https://insights.sbomify.com/GHSA-h4h3-3rfj-x6fq/index.md)","id":"GHSA-h4h3-3rfj-x6fq","markdown":"https://insights.sbomify.com/GHSA-h4h3-3rfj-x6fq/index.md","name":"GHSA-h4h3-3rfj-x6fq","record":{"aliases":[],"analysis":{"component_type":"database","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"SurrealDB database","requires_auth":"low_privilege","summary":"Authenticated users can infer the relative ordering of restricted database fields via indexed ORDER BY queries, leaking sensitive data structure.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"A field can be hidden from a user with a field-level SELECT permission (`DEFINE FIELD code ON secret PERMISSIONS FOR select WHERE owner = $auth.id`). When that field is indexed, a record user who cannot read it could still recover the relative ordering of its values across every record by issuing `ORDER BY \u003cfield\u003e`: the field came back `null` as intended, but the rows were returned in the hidden values' true sorted order.\n\nTo satisfy the sort, the planner selects the field's index and walks it in value order; the field-level permission is applied later, when the row is projected, so the value is nulled but the row order already encodes it. The guard that withholds restricted fields from the `WHERE` path was never applied to `ORDER BY`.\n\n## Impact\n\nWhat an attacker **can** do:\n\n- As a record (scope) user with table SELECT, learn the relative ordering of a field hidden by a field-level SELECT permission, across other users' records, by ordering on it when an index covers the field — the value returns `null`, but the rows come back in the hidden values' order.\n- With rows they control in the same table, use that ordering to narrow the hidden values toward exact ones.\n\nWhat it **can't** do:\n\n- Read the field value directly — only its relative ordering leaks; the projected value is correctly redacted.\n- Cross table, record, or namespace/database boundaries — the table's SELECT permission and any row-level `WHERE` are still enforced, so only records the caller may already read are ordered.\n- Leak anything when the restricted field is not indexed, affect root or record-owner sessions, or modify data (confidentiality only).\n\n## Patches\n\nThe query planner now applies the field-permission guard to the `ORDER BY` clause as well as the `WHERE` clause. When an ordered field is hidden from the caller by a field-level SELECT permission, the index sort pushdown is withheld and the rows are sorted after redaction instead, so the row order no longer reflects the hidden values. The dynamic-scan fallback is closed the same way, and a regression test was added.\n\nThe fix is included in SurrealDB 3.1.5.\n\n## Workarounds\n\nUsers unable to upgrade are advised to consider the following:\n\n- Force the legacy executor with `SURREAL_PLANNER_STRATEGY=compute-only`; the sort then runs after redaction, so no ordering leaks.\n- Do not place an index on a field whose values are hidden by a field-level SELECT permission — without the index the leak does not occur.\n- Do not rely on field-level SELECT permissions to hide values on indexed fields from record users; restrict at the table level instead.\n- Use namespace / database isolation as the primary trust boundary where feasible.\n\n## References\n\n- [SurrealQL Documentation — DEFINE FIELD](https://surrealdb.com/docs/surrealql/statements/define/field)\n- [SurrealQL Documentation — DEFINE INDEX](https://surrealdb.com/docs/surrealql/statements/define/indexes)\n- [SurrealQL Documentation — DEFINE TABLE … PERMISSIONS](https://surrealdb.com/docs/surrealql/statements/define/table)\n- Related advisory (same class, indexed COUNT variant): [GHSA-c8jx-96c9-8xrp](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-c8jx-96c9-8xrp)\n- `fix(planner): prevent ORDER BY value-ordering oracle on restricted SELECT fields`\n- `fix(planner): close ORDER BY value-ordering oracle on the DynamicScan fallback`\n\n## Acknowledgements\n\nThanks to George Chen ([@geo-chen](https://github.com/geo-chen)) for finding and reporting this issue.","ecosystems":["crates.io"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field","id":"GHSA-h4h3-3rfj-x6fq","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"crates.io","product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"crates.io","fixed":["3.1.5"],"introduced":["3.0.0"],"last_affected":[],"package":"surrealdb","purl":null,"source":"GHSA-h4h3-3rfj-x6fq"},{"ecosystem":"crates.io","fixed":["3.1.5"],"introduced":["3.0.0"],"last_affected":[],"package":"surrealdb","purl":"pkg:cargo/surrealdb","source":"GHSA-h4h3-3rfj-x6fq"}],"products":null,"published":"2026-06-19","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Authenticated users can infer the relative ordering of restricted database fields via indexed ORDER BY queries, leaking sensitive data structure.","url":"https://insights.sbomify.com/GHSA-h4h3-3rfj-x6fq/"}