⚠ Withdrawn by GitHub Security Advisories

Withdrawn: September 4, 2026

GHSA-mf42-3c8q-x7x8MediumCVSS 5.4Disclosed before NVD

Duplicate Advisory: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries

Published
July 20, 2026
Last Modified
September 4, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-gcwr-5mrf-fvch. This link is maintained to preserve external references.

Original Description

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.

🎯 Affected products1

  • rust/surrealdb:< 3.1.0

🔗 References (4)