CVE-2025-11060
Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions
- State
- Published
- Severity
- 5.7 Medium
- Published
- Sep 26, 2025
- Updated
- Nov 7, 2025
- Reserved
- Sep 26, 2025
Description
A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.7 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N | redhat |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
surrealdb |
|
OpenShift Service Mesh 3Red Hat | |
OpenShift Service Mesh 3Red Hat | |
OpenShift Service Mesh 3Red Hat | |
OpenShift Service Mesh 3Red Hat | |
OpenShift Service Mesh 3Red Hat | |
OpenShift Service Mesh 3Red Hat | |
OpenShift Service Mesh 3Red Hat | |
OpenShift Service Mesh 3Red Hat |
References
- https://access.redhat.com/security/cve/CVE-2025-11060vdb-entry
- RHBZ#2394708issue-tracking
- https://github.com/surrealdb/surrealdb
- https://github.com/surrealdb/surrealdb/commit/d81169a06b89f0c588134ddf2d62eeb8d5e8fd0c
- https://github.com/surrealdb/surrealdb/pull/6247
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-7vm2-j586-vcvc
- https://surrealdb.com/docs/surrealql/statements/live
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.