Threats tagged 'ghsa-gcwr-5mrf-fvch'

SurrealDB versions prior to 3.1.0 contain an authorization bypass vulnerability in the KILL statement used to terminate live query subscriptions. The implementation verifies database-level access but fails to confirm that the requesting user owns the live query being terminated. This allows any authenticated user with database-level access to terminate other users' live queries silently, disrupting real-time data subscriptions and breaking multi-tenant isolation. The vulnerability requires knowledge of the target live query UUID, which may be exposed through logs or shared dashboards. The issue has been patched in version 3.1.0 with an ownership verification check.