Executive brief
SurrealDB is a multi-model database that supports real-time data subscriptions. A security flaw allows users to continue receiving live data updates even after their login session has expired, been revoked, or after they have signed out. This could allow an unauthorized person to maintain access to sensitive real-time information until they manually disconnect from the server.
Technical details
SurrealDB before version 3.1.0 contains a session management vulnerability (CWE-613) where LIVE SELECT subscriptions fail to re-validate authentication state after the initial registration. The server snapshots the user's authorization state (including tokens and session variables) at the time of subscription but does not refresh this state when the session expires, is invalidated, or when a different user authenticates on the same connection. An attacker with existing low-privileged access can maintain a persistent connection to receive real-time notifications for resources they are no longer authorized to access. The vulnerability is limited to confidentiality (read-only access) and persists until the underlying network connection is closed. The issue is resolved in version 3.1.0 by ensuring subscriptions are terminated upon session invalidation or principal changes.
Affected products
- SurrealDB SurrealDB < 3.1.0
Timeline
- 2026-05-27: advisory: GitHub Security Advisory published
- 2026-07-20: disclosed: CVE published to NVD