Lucene search
+L

1 matches found

Github Security Blog
Github Security Blog
added 2026/06/19 10:10 p.m.26 views

SurrealDB: Indexed ORDER BY leaks the value ordering of a SELECT-restricted field

A field can be hidden from a user with a field-level SELECT permission DEFINE FIELD code ON secret PERMISSIONS FOR select WHERE owner = $auth.id. When that field is indexed, a record user who cannot read it could still recover the relative ordering of its values across every record by issuing ORD...

5.9AI score
SaveExploits0References2Affected Software1
Rows per page
Query Builder