Log in Start free

Vulnerability · Published Sep 26, 2025 · Assigned by redhat

CVE-2025-11060Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions

Medium 5.7

In plain English

A medium-severity incorrect authorization in surrealdb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)5.7Medium
Exploit odds (30 days)0.3%top 74.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.

Affected products (as reported)

VendorProductVersions
surrealdb 0 – before 2.1.92.2.0 – before 2.2.82.3.0 – before 2.3.83.3.0 – before 3.3.0-alpha.7
Red Hat OpenShift Service Mesh 3 see references
Red Hat OpenShift Service Mesh 3 see references
Red Hat OpenShift Service Mesh 3 see references
Red Hat OpenShift Service Mesh 3 see references
Red Hat OpenShift Service Mesh 3 see references
Red Hat OpenShift Service Mesh 3 see references
Red Hat OpenShift Service Mesh 3 see references
Red Hat OpenShift Service Mesh 3 see references

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

References