CVE-2026-63749 · Symaro Security Advisory

Description

SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $before, $after, or $event are evaluated against attacker-controlled bindings instead of actual documents. Authenticated subscribers can bind chosen values to these parameter names and register LIVE SELECT queries to receive notifications for records that SELECT permission expressions should have hidden.

Severity (CVSS)

Base score	5.3
Severity	Medium
Version	CVSS 4.0
Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Provided by	CNA

Weaknesses

CWE-863 — Incorrect Authorization

Affected products

Vendor	Product	Versions
surrealdb	surrealdb	0 to <3.1.0; 3.1.0

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6wqw-vhfr-9999 (vendor-advisory)
https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-live-select (third-party-advisory)

Authoritative sources

This page is a snapshot. For the latest enrichment and updates, view the record on CVE.org or the NVD.

Generated from the official CVE List on 21 Jul 2026 07:01 UTC.