CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 3.1.0 are vulnerable to an authorization bypass in the KILL statement, enabling authenticated users to terminate other users' live SELECT subscriptions without proper ownership verification. This flaw can be exploited to disrupt real-time data access for other users, potentially leading to data availability issues. Database administrators and security teams using affected versions should prioritize patching to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other users' LIVE SELECT subscriptions. Attackers can issue KILL statements with target live query UUIDs to disrupt real-time data subscriptions of other users without ownership verification.
Related CVEs
Other vulnerabilities affecting the same vendor(s)