Lucyegan

**Name of the Vulnerable Software and Affected Versions** SurrealDB versions prior to 3.1.0 **Description** An issue exists where the system fails to refresh the authentication state in LIVE SELECT subscriptions when the session state changes. This allows an attacker to continue receiving real-time notifications even after session credentials have been revoked or have expired, provided the connection remains open. **Recommendations** Update to version 3.1.0 or later.

SurrealDB versions before 3.1.0 contain a denial of service vulnerability where malicious LIVE queries with WHERE clauses that evaluate to errors cause all CREATE, UPDATE, and DELETE operations on the watched table to fail. An authenticated user with only select permission can prevent write operations on a table for any user, including root, by registering a LIVE query that triggers evaluation errors until the query is killed or the session ends.

**Name of the Vulnerable Software and Affected Versions** SurrealDB versions prior to 3.1.0 **Description** An ordering flaw exists where user-supplied `WHERE` clauses in `SELECT` statements, as well as `SET`, `MERGE`, `CONTENT`, and `PATCH` clauses in `UPDATE`, `UPSERT`, `INSERT ON DUPLICATE KEY UPDATE`, and `RELATE` update-variant statements, are evaluated against full record data before `PERMISSIONS FOR SELECT WHERE` restrictions are enforced. An authenticated user, including Record and Scope users, can exploit this to bypass table-level permission checks and read the full contents of any table within the database they are authenticated against. Data exfiltration is most direct when scripting functions are enabled via the `--allow-scripting` flag, but it is also possible using the `THROW` statement or timing-based side channels. This issue is confined to the current database and does not cross namespace or database isolation boundaries. **Recommendations** Update to version 3.1.0 or later. Disable scripting functions by removing the `-A` or `--allow-scripting` flag to block the most direct exfiltration method. Restrict the ability of untrusted principals to execute arbitrary `SELECT` queries with user-controlled `WHERE` clauses. Use namespace or database isolation as the primary security boundary instead of table-level permissions.

**Name of the Vulnerable Software and Affected Versions** SurrealDB versions prior to 2.6.1 SurrealDB versions prior to 3.0.0-beta.3 **Description** A denial of service issue exists in the embedded JavaScript scripting engine, which is activated by the `--allow-scripting` capability. Users capable of executing arbitrary queries, including unauthenticated guests if `--allow-guests` is enabled, can use built-in string functions to create a large string and send it to the JavaScript runtime for compilation. This action triggers a null pointer dereference—a condition where the program attempts to read a memory address that is null—within the QuickJS-NG engine, causing the server process to terminate abruptly and requiring a manual restart. **Recommendations** Update SurrealDB to version 2.6.1 or later. Update SurrealDB to version 3.0.0-beta.3 or later. Disable the `--allow-scripting` capability to prevent the use of the vulnerable JavaScript engine.

**Name of the Vulnerable Software and Affected Versions** SurrealDB versions prior to 1.0.1 **Description** Default table permissions are set to FULL instead of NONE, which allows SELECT, CREATE, UPDATE, and DELETE operations on tables that lack explicit permissions. This allows attackers with database access or unauthenticated users on publicly exposed instances to perform unrestricted operations on unprotected tables within their authorization scope. **Recommendations** Update SurrealDB to version 1.0.1 or later.