EUVD-2026-45920
GHSA-75qw-w395-xvv7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible subscription service, low complexity; requires authenticated record user (PR:L); impact is low confidentiality only, read-only and table-scoped, no scope change.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $before, $after, or $event are evaluated against attacker-controlled bindings instead of actual documents. Authenticated subscribers can bind chosen values to these parameter names and register LIVE SELECT queries to receive notifications for records that SELECT permission expressions should have hidden.
AnalysisAI
Authorization bypass in SurrealDB LIVE SELECT subscriptions allows authenticated record users to receive real-time notifications for records that table-level SELECT permission expressions should have filtered out. Affected versions before 3.1.0 incorrectly evaluate permission expressions against attacker-supplied variable bindings rather than trusted document context when the expression references $value, $before, $after, or $event. No public exploit code has been identified and the issue is not listed in CISA KEV, but the bypass is straightforward for any authenticated subscriber on a vulnerable deployment using the affected variable names in permission logic.
Technical ContextAI
SurrealDB is a multi-model database written in Rust that supports real-time query subscriptions via LIVE SELECT statements. CWE-863 (Incorrect Authorization) applies here: the root cause is a binding-order flaw in the LIVE notification pipeline. When a subscriber pre-binds a session variable (e.g., LET $value = [$auth.id]) before registering a LIVE SELECT, the runtime processes user-captured bindings after the trusted document-context parameters are established. This ordering means the attacker's binding for $value, $before, $after, or $event shadows the real document value that the permission expression is supposed to evaluate against. The fix (commit 6bcc55c9c0494a0d4d36821019b54459f7162af7) reverses the binding order so trusted document-context and session parameters are added last, overwriting any prior user-supplied values. Permission expressions that reference only field names, $auth, or $session are unaffected because those names are not shadowed by the flaw.
RemediationAI
Upgrade SurrealDB to version 3.1.0 or later; this is the vendor-confirmed fixed release per GHSA-6wqw-vhfr-9999 and the upstream patch commit at https://github.com/surrealdb/surrealdb/commit/6bcc55c9c0494a0d4d36821019b54459f7162af7. For deployments unable to upgrade immediately, the vendor recommends avoiding table PERMISSIONS and LIVE WHERE expressions that read user-named variables ($value, $before, $after, $event) without also gating on a system-derived field such as the record id - for example, rewriting a permission like WHERE $auth.id.id() IN $value to instead traverse a relationship anchored to a trusted system field. Note that this workaround requires auditing all table permission definitions and may involve rewriting application-level query logic; it does not eliminate the underlying flaw but removes the exploitable condition.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today