GHSA-98f8-j56x-2hh4

Suggest an improvement
Source
https://github.com/advisories/GHSA-98f8-j56x-2hh4
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-98f8-j56x-2hh4/GHSA-98f8-j56x-2hh4.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-98f8-j56x-2hh4
Withdrawn
2025-09-26T16:57:37Z
Published
2025-09-26T15:30:28Z
Modified
2025-09-26T16:57:37Z
Severity
  • 5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Duplicate Advisory: SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-7vm2-j586-vcvc. This link is maintained to preserve external references.

Original Description

A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.

Database specific 
{
    "cwe_ids": [
        "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-09-26T16:57:37Z",
    "nvd_published_at": "2025-09-26T13:15:41Z",
    "severity": "MODERATE"
}
References

Affected packages

crates.io / surrealdb

Package

Name
surrealdb
View open source insights on deps.dev
Purl
pkg:cargo/surrealdb

Affected ranges

Type
SEMVER
Events
Introduced
2.3.0

Database specific

last_known_affected_version_range 
"< 2.3.8"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-98f8-j56x-2hh4/GHSA-98f8-j56x-2hh4.json"