CVE-2025-11060CWE-863broken-access-control

CVE-2025-11060

Medium · published September 26, 2025

CVSS v3.1
5.7
EPSS
0%
Percentile
24.6
In the wild
Unconfirmed
What it is

A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2025-09-26T17:15Z
References (7)
https://access.redhat.com/security/cve/CVE-2025-11060 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2394708 · [email protected]https://github.com/surrealdb/surrealdb · [email protected]https://github.com/surrealdb/surrealdb/commit/d81169a06b89f0c588134ddf2d62eeb8d5e8fd0c · [email protected]https://github.com/surrealdb/surrealdb/pull/6247 · [email protected]https://github.com/surrealdb/surrealdb/security/advisories/GHSA-7vm2-j586-vcvc · [email protected]https://surrealdb.com/docs/surrealql/statements/live · [email protected]
EPSS history
Timeline
  • 26 SEP 12:01Z
    Surrealdb: surrealdb is vulnerable to unauthorized data exposure via live query subscriptions
    cvelistv5