Executive brief
SurrealDB is a multi-model database that supports real-time data subscriptions. A vulnerability in the way it handles live data updates allows authenticated users to bypass security rules and view records they are not authorized to see. This could lead to unauthorized access to sensitive information within a specific database table.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in SurrealDB's LIVE SELECT functionality. The root cause is a parameter binding order issue where user-defined variables can shadow trusted system variables like $value, $before, $after, or $event. An authenticated attacker can bind a custom value to these names before registering a LIVE SELECT subscription, causing the database to evaluate permission expressions against the attacker's input rather than the actual document. This allows the attacker to receive real-time notifications for all records in a table, bypassing row-level SELECT permissions. The issue is fixed in version 3.1.0 by re-ordering parameter bindings so trusted system parameters are added last.
Affected products
- SurrealDB surrealdb < 3.1.0
Timeline
- 2026-05-27: disclosed
- 2026-07-01: advisory
- 2026-07-01: patched: Fixed in version 3.1.0
References
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6wqw-vhfr-9999
- https://github.com/surrealdb/surrealdb/commit/6bcc55c9c0494a0d4d36821019b54459f7162af7
- https://github.com/orgs/surrealdb/discussions/101
- https://api.github.com/repos/surrealdb/surrealdb/security-advisories/GHSA-6wqw-vhfr-9999