What is GHSA-mf42-3c8q-x7x8?

GHSA-mf42-3c8q-x7x8 is a security advisory published by GitHub Security Advisories with Medium severity. SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL...

Which CVE IDs does GHSA-mf42-3c8q-x7x8 cover?

GHSA-mf42-3c8q-x7x8 covers the following CVE IDs: CVE-2026-63758. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mf42-3c8q-x7x8?

GHSA-mf42-3c8q-x7x8 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

GHSA-mf42-3c8q-x7x8MediumCVSS 5.4

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL...

Vendor

GitHub Security Advisories

Published

July 20, 2026

Last Modified

July 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-63758 →

📋 Description

SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.

🔗 References (4)

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gcwr-5mrf-fvch
https://nvd.nist.gov/vuln/detail/CVE-2026-63758
https://www.vulncheck.com/advisories/surrealdb-before-authorization-bypass-via-kill-statement
https://github.com/advisories/GHSA-mf42-3c8q-x7x8