Vulnerability · Published Jul 20, 2026 · Assigned by VulnCheck

CVE-2026-63749SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT

Medium 4.3

In plain English

A medium-severity incorrect authorization in surrealdb from surrealdb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.4%top 70.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $before, $after, or $event are evaluated against attacker-controlled bindings instead of actual documents. Authenticated subscribers can bind chosen values to these parameter names and register LIVE SELECT queries to receive notifications for records that SELECT permission expressions should have hidden.

Affected products (as reported)

Vendor	Product	Versions
surrealdb	surrealdb	0 – before 3.1.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

GitHub Security Advisory (GHSA-6wqw-vhfr-9999) vendor-advisory
VulnCheck Advisory: SurrealDB before 3.1.0 Authentication Bypass via LIVE SELECT third-party-advisory