CVE-2025-11060

A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.

CVSS v3 5.7 MEDIUM

5.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.1 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-11060
https://bugzilla.redhat.com/show_bug.cgi?id=2394708
https://github.com/surrealdb/surrealdb
https://github.com/surrealdb/surrealdb/commit/d81169a06b89f0c588134ddf2d62eeb8d5e8fd0c
https://github.com/surrealdb/surrealdb/pull/6247
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-7vm2-j586-vcvc
https://surrealdb.com/docs/surrealql/statements/live

Configurations

No configuration.

History

09 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Se encontró una falla en el mecanismo de suscripción de consultas en vivo del motor de la base de datos. Esta vulnerabilidad permite a usuarios registrados o invitados observar registros no autorizados dentro de la misma tabla, eludiendo los controles de acceso, a través de suscripciones LIVE SELECT manipuladas cuando otros usuarios modifican o eliminan registros.

Information

Published : 2025-09-26 13:15

Updated : 2026-10-09 10:10

NVD link : CVE-2025-11060

Mitre link : CVE-2025-11060

CVE.ORG link : CVE-2025-11060

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2025-11060", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11060", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-26T13:04:07.005443Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.1}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"versions": [{"status": "affected", "version": "0", "lessThan": "2.1.9", "versionType": "semver"}, {"status": "affected", "version": "2.2.0", "lessThan": "2.2.8", "versionType": "semver"}, {"status": "affected", "version": "2.3.0", "lessThan": "2.3.8", "versionType": "semver"}, {"status": "affected", "version": "3.3.0", "lessThan": "3.3.0-alpha.7", "versionType": "semver"}], "packageName": "surrealdb", "collectionURL": "https://github.com/surrealdb/surrealdb/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:service_mesh:3"], "vendor": "Red Hat", "product": "OpenShift Service Mesh 3", "packageName": "openshift-service-mesh-dev-preview-beta/istio-ztunnel-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:service_mesh:3"], "vendor": "Red Hat", "product": "OpenShift Service Mesh 3", "packageName": "openshift-service-mesh/istio-cni-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:service_mesh:3"], "vendor": "Red Hat", "product": "OpenShift Service Mesh 3", "packageName": "openshift-service-mesh/istio-must-gather-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:service_mesh:3"], "vendor": "Red Hat", "product": "OpenShift Service Mesh 3", "packageName": "openshift-service-mesh/istio-pilot-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:service_mesh:3"], "vendor": "Red Hat", "product": "OpenShift Service Mesh 3", "packageName": "openshift-service-mesh/istio-proxyv2-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:service_mesh:3"], "vendor": "Red Hat", "product": "OpenShift Service Mesh 3", "packageName": "openshift-service-mesh/istio-rhel9-operator", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:service_mesh:3"], "vendor": "Red Hat", "product": "OpenShift Service Mesh 3", "packageName": "openshift-service-mesh/istio-sail-operator-bundle", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:service_mesh:3"], "vendor": "Red Hat", "product": "OpenShift Service Mesh 3", "packageName": "openshift-service-mesh-tech-preview/istio-ztunnel-rhel9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2025-09-26T13:15:41.757", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-11060", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2394708", "source": "secalert@redhat.com"}, {"url": "https://github.com/surrealdb/surrealdb", "source": "secalert@redhat.com"}, {"url": "https://github.com/surrealdb/surrealdb/commit/d81169a06b89f0c588134ddf2d62eeb8d5e8fd0c", "source": "secalert@redhat.com"}, {"url": "https://github.com/surrealdb/surrealdb/pull/6247", "source": "secalert@redhat.com"}, {"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-7vm2-j586-vcvc", "source": "secalert@redhat.com"}, {"url": "https://surrealdb.com/docs/surrealql/statements/live", "source": "secalert@redhat.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el mecanismo de suscripci\u00f3n de consultas en vivo del motor de la base de datos. Esta vulnerabilidad permite a usuarios registrados o invitados observar registros no autorizados dentro de la misma tabla, eludiendo los controles de acceso, a trav\u00e9s de suscripciones LIVE SELECT manipuladas cuando otros usuarios modifican o eliminan registros."}], "lastModified": "2026-10-09T10:10:00.193", "sourceIdentifier": "secalert@redhat.com"}