CVE-2026-63749Medium· 4.3▾ SunlitSurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
A record user could read records the table's SELECT permission expression should have hidden, when that expression referenced $value, $before, $after, or $event. Binding a chosen value to that name before registering a LIVE SELECT caused notifications to evaluate the permission against the attacker's input instead of the real document.
A record user binds a value to $value, $before, $after, or $event (e.g. LET $value = [$auth.id]) and registers LIVE SELECT * FROM person. The captured value shadows the real document at notification time, so a SELECT permission like WHERE $auth.id.id() IN $value passes for every record on the table — the subscriber receives notifications for records they should not see.
Read-only impact, bounded to one table. Permission expressions that reference only field names, $auth, or $session are unaffected.
A patch has been introduced that re-orders the LIVE notification parameter binding so captured user variables are added first and the trusted document-context and session parameters are added last.
Affected users who are unable to update should avoid table-PERMISSIONS and LIVE WHERE expressions that read user-named variables ($value, $before, $after, $event) without also gating on a system-derived field such as the record id.
surrealdb < 3.1.0Upgrade to a patched release:
surrealdb 3.1.0Connected by shared product, vendor, weakness, or advisory.
GHSA-6wqw-vhfr-9999Medium· 4.3SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions
CVE-2026-63741Medium· 6.5SurrealDB: USE NS/DB implicit creation bypasses DEFINE authorization
CVE-2026-63759Medium· 6.5SurrealDB vulnerable to Denial of Service due to nested types annotations
CVE-2026-63747High· 7.5SurrealDB has unauthenticated remote DoS via malformed RPC `use` call
CVE-2026-63744Medium· 4.1SurrealDB: SSRF via JWKS URL — Redirect Following in JWT Key Fetch
CVE-2026-63737Medium· 6.5SurrealDB: Denial of Service via deep operator chains