Medium severity5.7OSV Advisory· Published Sep 26, 2025· Updated Apr 15, 2026
CVE-2025-11060
CVE-2025-11060
Description
A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
SurrealDBcrates.io | >= 2.3.0, < 2.3.8 | 2.3.8 |
SurrealDBcrates.io | >= 2.2.0, < 2.2.8 | 2.2.8 |
SurrealDBcrates.io | < 2.1.9 | 2.1.9 |
SurrealDBcrates.io | >= 3.0.0-alpha.0, < 3.0.0-alpha.8 | 3.0.0-alpha.8 |
Affected products
2Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-7vm2-j586-vcvcghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-11060ghsaADVISORY
- access.redhat.com/security/cve/CVE-2025-11060nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/surrealdb/surrealdb/commit/d81169a06b89f0c588134ddf2d62eeb8d5e8fd0cnvdWEB
- github.com/surrealdb/surrealdb/pull/6247nvdWEB
- github.com/surrealdb/surrealdb/security/advisories/GHSA-7vm2-j586-vcvcnvdWEB
- surrealdb.com/docs/surrealql/statements/livenvdWEB
News mentions
0No linked articles in our index yet.