-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability, GHSA-7vm2-j586-vcvc, allows unauthorized data exposure in SurrealDB's LIVE SELECT queries. The root cause is that the system failed to apply the security permissions of the live query subscriber when generating data notifications. Instead, it used the permissions of the user who triggered the data change, leading to a classic confused deputy problem where a less-privileged user could see data they were not authorized to access.
The analysis of the patch commit d81169a06b89f0c588134ddf2d62eeb8d5e8fd0c reveals that the core logic for handling live query notifications was flawed. The function Document::lq_process was identified as the primary vulnerable function. It was responsible for processing the notifications but did so on the complete, un-redacted data. The fix involves introducing a call to compute_reduced_target within lq_process to explicitly reduce the document according to the subscriber's permissions before any data is sent.
Additionally, the Document::pluck function was complicit in the vulnerability. It was incorrectly used to generate the payload for live queries, using the wrong security context. The patch corrects this by removing the live query handling logic from pluck and introducing a new dedicated function, lq_pluck, ensuring that live query data is handled separately and securely.
An engineer with this CVE in their environment should understand that any user with permission to run LIVE SELECT on a table could potentially access all data in that table, bypassing any row-level or field-level security policies. Patching is critical to prevent this confidentiality breach.
RustRust| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| SurrealDB | rust | >= 2.3.0, < 2.3.8 | 2.3.8 |
| SurrealDB | rust | >= 2.2.0, < 2.2.8 | 2.2.8 |
| SurrealDB | rust |
| < 2.1.9 |
| 2.1.9 |
Ongoing coverage of React2Shell