{"id":"CVE-2025-11060","summary":"Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions","details":"A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.","aliases":["GHSA-7vm2-j586-vcvc"],"modified":"2026-10-22T10:33:27.746903588Z","published":"2025-09-26T12:01:22.738Z","database_specific":{"cna_assigner":"redhat","cwe_ids":["CWE-863"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11060.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"3.3.0"},{"fixed":"3.3.0-alpha.7"}]}]}]},"references":[{"type":"WEB","url":"https://access.redhat.com/downloads/content/package-browser/"},{"type":"WEB","url":"https://github.com/surrealdb/surrealdb/"},{"type":"WEB","url":"https://surrealdb.com/docs/surrealql/statements/live"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2025-11060"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/11xxx/CVE-2025-11060.json"},{"type":"ADVISORY","url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-7vm2-j586-vcvc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-11060"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2394708"},{"type":"FIX","url":"https://github.com/surrealdb/surrealdb/commit/d81169a06b89f0c588134ddf2d62eeb8d5e8fd0c"},{"type":"FIX","url":"https://github.com/surrealdb/surrealdb/pull/6247"},{"type":"PACKAGE","url":"https://github.com/surrealdb/surrealdb"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/surrealdb/surrealdb","events":[{"introduced":"0"},{"fixed":"28a7d09b976f4ffa3a29b4e5ec3367312318a29d"},{"introduced":"0ee8dc2c3ec8e883038d0ee00bbce6a6126fe655"},{"fixed":"c620546b851ed0b54f35279d9c48c0d066243cce"},{"introduced":"c59db3bbfb8d3eab03f47129a2d77812311cfd69"},{"fixed":"e14d49ad61aa15e6a4bd3088a0ea40a6a301e5d3"},{"fixed":"d81169a06b89f0c588134ddf2d62eeb8d5e8fd0c"}],"database_specific":{"extracted_events":[{"range":[{"introduced":"0"},{"fixed":"2.1.9"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"range":[{"introduced":"2.2.0"},{"fixed":"2.2.8"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"},{"strategy":"StandardRange","range":[{"introduced":"2.3.0"},{"fixed":"2.3.8"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"d81169a06b89f0c588134ddf2d62eeb8d5e8fd0c"}]}]}}],"versions":["v2.2.7","v2.1.8","v2.2.6","v2.3.5","v2.2.5","v2.1.7","v2.1.6","v2.2.4","v2.3.4","v2.3.2","v2.1.5","v2.2.3","v2.3.1","v2.2.2","v2.3.0","v3.0.0-alpha.2","v2.2.1","v2.1.4","v2.0.4","v2.2.0","v2.1.3","v2.1.2","v2.1.1","v2.1.0","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v2.0.0-beta.3","v2.0.0-beta.2","v2.0.0-beta.1","v2.0.0-alpha.9","v2.0.0-alpha.8","v2.0.0-alpha.7","v2.0.0-alpha.6","v2.0.0-alpha.5","v2.0.0-alpha.4","v2.0.0-alpha.3","v2.0.0-alpha.2","v2.0.0-alpha.1","v1.0.0","v1.0.0-beta.12","v1.0.0-beta.11","v1.0.0-beta.10","v1.0.0-beta.9+20230402","v1.0.0-beta.9","v1.0.0-beta.8","v1.0.0-beta.7","v1.0.0-beta.6","v1.0.0-beta.5","v1.0.0-beta.4","v1.0.0-beta.3","v1.0.0-beta.2","v1.0.0-beta.1","v0.3.0","v0.1.30","v0.1.29","v0.1.28","v0.1.27","v0.1.26","v0.1.25","v0.1.24","v0.1.23","v0.1.22","v0.1.21","v0.1.20","v0.1.19","v0.1.18","v0.1.17","v0.1.16","v0.1.15","v0.1.14","v0.1.13","v0.1.12","v0.1.11","v0.1.10","v0.1.9","v0.1.8","v0.1.7","v0.1.6","v0.1.5","v0.1.4","v0.1.3","v0.1.2","v0.1.1","v0.1.0"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-11060.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N"}]}