Duplicate Advisory: SurrealDB: Authorization Bypass in KILL Statement Allows Termination of Other Users' Live Queries

SurrealDB prior to version 3.1.0 contains an authorization bypass vulnerability (CWE-862) in the KILL statement functionality. Authenticated database users can issue KILL commands targeting live query UUIDs belonging to other users, terminating their live SELECT subscriptions without proper ownership checks. This allows disruption of other users' real-time data subscriptions. The vulnerability does not impact confidentiality but affects integrity and availability. No known exploits in the wild have been reported. No patch or remediation information is provided in the advisory, and the advisory is marked as a duplicate of GHSA-gcwr-5mrf-fvch.

The vulnerability allows authenticated users to disrupt other users' live query subscriptions by terminating them without authorization. This impacts the availability and integrity of live data subscriptions but does not affect confidentiality. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory GHSA-gcwr-5mrf-fvch for current remediation guidance. Since no patch or fix links are provided, users should monitor the vendor's official advisories for updates. Until a fix is available, restrict access to trusted users to minimize risk.