GHSA-mf42-3c8q-x7x8

Source

https://github.com/advisories/GHSA-mf42-3c8q-x7x8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mf42-3c8q-x7x8/GHSA-mf42-3c8q-x7x8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mf42-3c8q-x7x8

Withdrawn

2026-09-04T20:18:26Z

Published

2026-07-20T12:33:10Z

Modified

2026-09-04T20:30:04Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L CVSS Calculator
5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Duplicate Advisory: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-gcwr-5mrf-fvch. This link is maintained to preserve external references.

Original Description

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.

Database specific

{
    "cwe_ids":  [
        "CWE-862"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-04T20:18:26Z",
    "nvd_published_at":  "2026-07-20T12:19:45Z",
    "severity":  "MODERATE"
}

References

Affected packages

crates.io / surrealdb

Package

Name: surrealdb; View open source insights on deps.dev
Purl: pkg:cargo/surrealdb

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Database specific

last_known_affected_version_range

"< 3.1.0"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-mf42-3c8q-x7x8/GHSA-mf42-3c8q-x7x8.json"