5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-98f8-j56x-2hh4

GHSA-98f8-j56x-2hh4: Duplicate Advisory: SurrealDB is Vulnerable to Unauthorized Data Exposure via LIVE Query Subscriptions

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-7vm2-j586-vcvc. This link is maintained to preserve external references.

Original Description

A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-98f8-j56x-2hh4

GHSA-98f8-j56x-2hh4:

5.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
surrealdb	rust	>= 2.3.0, < 2.3.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the incorrect application of permissions within SurrealDB's live query mechanism. When a user subscribes to a live query, they should only receive updates for data they are authorized to see. However, the flaw caused the system to evaluate permissions based on the user who triggered the data change (e.g., via an UPDATE or DELETE statement), not the user who was subscribed to the live query.

The root cause is traced to the surrealdb_core::doc::document::Document::lives function. This function is the central hub for handling live query notifications. The original implementation failed to switch the permission context to that of the live query subscriber. It processed the data change with the permissions of the user who initiated the change. Consequently, if a high-privileged user modified a record, a low-privileged user subscribed to a matching live query could receive a notification containing sensitive data they were not supposed to see.

The patch addresses this by making several key changes:

In the lives function, it now explicitly creates a new options object (lqopt) that contains the authentication details of the live query subscriber.
It then uses this lqopt to perform a new compute_reduced_target operation, which correctly strips out any fields from the record that the subscriber is not permitted to view.
The logic for handling live query data selection was moved out of the generic pluck function and into a new, dedicated lq_pluck function to ensure the correct context is always used.

The vulnerable functions Document::lives and Document::pluck would appear in a runtime profile during exploitation. An attacker would first establish a live query on a table. Then, when a privileged user modifies a record in that table, the lives function would be invoked on the server. This would in turn call pluck (in the vulnerable version), which would incorrectly apply permissions and send the sensitive data to the attacker.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.