CVE-2025-11060
Medium
Description
A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.
SeverityMedium
CVSS5.7
Exploit probability—
Product
Surrealdb
PublishedSep 26, 2025
First seenSep 26, 2025
Weakness typeCWE-863Incorrect authorization
How to fix
Update
- surrealdb2.1.9, 2.2.8, 2.3.8, 3.3.0-alpha.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| surrealdb | v < 2.1.9, 2.2.0 ≤ v < 2.2.8, 2.3.0 ≤ v < 2.3.8, 3.3.0 ≤ v < 3.3.0-alpha.7 | 2.1.9, 2.2.8, 2.3.8, 3.3.0-alpha.7 |
| Red Hat OpenShift Service Mesh 3 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.