CVE-2026-63758CWE-862

SurrealDB before 3.1.0 Authorization Bypass via KILL Statement

Medium · published July 20, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
22.5
In the wild
Unconfirmed
What it is

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00309 · 22.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-20T12:04Z
EPSS history
Timeline
  • 20 JUL 12:04Z
    SurrealDB before 3.1.0 Authorization Bypass via KILL Statement
    cvelistv5