{"id":"EUVD-2025-31339","revision":"43caa6033c934f519007659eddac6a23","records":[{"revision":"43caa6033c934f519007659eddac6a23","observedAt":"2026-10-29T21:51:01.924+00:00","statement":{"source":"euvd","id":"EUVD-2025-31339","aliases":["CVE-2025-11060","GHSA-7vm2-j586-vcvc","GHSA-98f8-j56x-2hh4"],"title":"A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subs…","description":"A flaw was found in the live query subscription mechanism of the database engine. This vulnerability allows record or guest users to observe unauthorized records within the same table, bypassing access controls, via crafted LIVE SELECT subscriptions when other users alter or delete records.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","score":5.7,"severity":null}],"references":["https://access.redhat.com/security/cve/CVE-2025-11060","https://bugzilla.redhat.com/show_bug.cgi?id=2394708","https://github.com/surrealdb/surrealdb","https://github.com/surrealdb/surrealdb/commit/d81169a06b89f0c588134ddf2d62eeb8d5e8fd0c","https://github.com/surrealdb/surrealdb/pull/6247","https://github.com/surrealdb/surrealdb/security/advisories/GHSA-7vm2-j586-vcvc","https://surrealdb.com/docs/surrealql/statements/live"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-31339","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 26, 2025, 12:01:22 PM","dateUpdated":"Nov 7, 2025, 7:42:32 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-31339","identifiers":["EUVD-2025-31339","CVE-2025-11060","GHSA-7vm2-j586-vcvc","GHSA-98f8-j56x-2hh4"]},"retained":false,"historicalAffected":[]}],"coverage":[]}