EUVD-2026-45924
GHSA-9567-jfw6-h5pc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible via WebSocket RPC; authenticated session required (PR:L) to register LIVE queries; confidentiality-only impact limited to already-permitted data, no integrity or availability effect.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB before 3.1.0 fails to refresh authentication state in LIVE SELECT subscriptions when session state changes. Attackers can continue receiving real-time notifications under revoked or expired session credentials until the connection closes.
AnalysisAI
LIVE SELECT subscriptions in SurrealDB before 3.1.0 persist real-time change notifications under revoked, expired, or superseded session credentials, violating session boundary enforcement. Authenticated users who register a LIVE SELECT query retain delivery of change notifications after their session is invalidated, expires via TTL, or is replaced by a different identity authenticating on the same WebSocket connection. No public exploit has been identified and no active exploitation is confirmed; vendor-released patch is available in SurrealDB 3.1.0.
Technical ContextAI
SurrealDB is a multi-model database written in Rust, exposing a WebSocket-based RPC protocol for clients. The LIVE SELECT feature allows clients to subscribe to real-time change notifications on tables or rows. At subscription registration, the server snapshots the session's full authentication context - the variables $auth, $token, $session, and $access - and uses this frozen snapshot to evaluate table- and row-level PERMISSIONS clauses for every subsequent notification dispatched on that subscription. The root cause is CWE-613 (Insufficient Session Expiration): the captured auth snapshot is never refreshed or invalidated when the originating session's state changes, even though the WebSocket transport layer and its subscriptions remain alive. The fix, delivered across commits 6cc48412c975d51b47617708ec44abc11ca5a89a and cbec0a73dc9575994d2b9c1aec26af539dc99878, introduces cleanup_lqs(session_id) calls upon session invalidation and principal change, and adds a TTL expiry guard in the notification dispatcher that skips delivery once the originating session's exp timestamp has passed.
RemediationAI
Upgrade to SurrealDB 3.1.0 or later, the confirmed vendor-released fix documented in GHSA-4m82-p8cx-f94j (https://github.com/surrealdb/surrealdb/security/advisories/GHSA-4m82-p8cx-f94j). The underlying changes are delivered in commits 6cc48412c975d51b47617708ec44abc11ca5a89a and cbec0a73dc9575994d2b9c1aec26af539dc99878. For deployments that cannot upgrade immediately, clients should explicitly call reset() to tear down all LIVE queries associated with the session, or individually kill each outstanding live query ID by its query ID, before performing any signout, signin, signup, or authenticate operation on an existing connection. This client-side workaround carries the trade-off of requiring application-layer discipline and does not close the TTL-expiry leg - when a session's time-to-live elapses while a LIVE SELECT remains active, there is no client-side mitigation; only upgrading to 3.1.0 resolves that case.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-613 – Insufficient Session Expiration
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today