SurrealDB versions prior to 3.1.5 allow authenticated users to bypass field‑level SELECT permissions in ORDER BY clauses, exposing the relative ordering of values in restricted fields. This leakage can be used to infer sensitive information about the hidden data by observing how records sort, even though a direct query returns null. The vulnerability is a moderate severity information‑disclosure flaw identified by CWE‑863.

All installations of SurrealDB older than version 3.1.5 are affected. The issue occurs when users have permission to query the database but lack permission to read specific fields; this is inferred from the description. The vulnerability is vendor‑specific to SurrealDB and does not affect other database products.

The CVSS score of 5.3 indicates a medium impact, while an EPSS score of less than 1% suggests that exploitation is unlikely at this time. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated and able to construct ORDER BY queries on indexed fields that are protected by custom SELECT permissions. Once the query is executed, the server returns the ordering of the values, allowing the attacker to recover the relative positions of the restricted data across records.