Authentication Bypass in SurrealDB Affecting LIVE SELECT Subscriptions

CVE-2026-63749

What is CVE-2026-63749?

SurrealDB versions prior to 3.1.0 have a vulnerability that allows an authentication bypass through its LIVE SELECT subscriptions. This occurs when permission expressions that reference the parameters $value, $before, $after, or $event are improperly evaluated against attacker-controlled data instead of legitimate document values. As a result, authenticated users can manipulate these parameters and register LIVE SELECT queries to receive notifications for records that should be obscured by the intended permission controls, leading to potential unauthorized access to sensitive information.

References