Unrated severityNVD Advisory· Published Jul 20, 2026· Updated Jul 28, 2026
SurrealDB before 3.1.0 Authorization Bypass via KILL Statement
CVE-2026-63758
Description
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.
Affected products
1Patches
Vulnerability mechanics
References
2- github.com/surrealdb/surrealdb/security/advisories/GHSA-gcwr-5mrf-fvchmitrevendor-advisory
- www.vulncheck.com/advisories/surrealdb-before-authorization-bypass-via-kill-statementmitrethird-party-advisory
News mentions
0No linked articles in our index yet.