What is GHSA-75qw-w395-xvv7?

GHSA-75qw-w395-xvv7 is a security advisory published by GitHub Security Advisories with Medium severity. SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT...

Which CVE IDs does GHSA-75qw-w395-xvv7 cover?

GHSA-75qw-w395-xvv7 covers the following CVE IDs: CVE-2026-63749. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-75qw-w395-xvv7?

GHSA-75qw-w395-xvv7 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-75qw-w395-xvv7MediumCVSS 4.3

SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT...

Vendor

GitHub Security Advisories

Published

July 20, 2026

Last Modified

July 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-63749 →

📋 Description

SurrealDB versions before 3.1.0 contain an authentication bypass vulnerability in LIVE SELECT subscriptions where permission expressions referencing $value, $before, $after, or $event are evaluated against attacker-controlled bindings instead of actual documents. Authenticated subscribers can bind chosen values to these parameter names and register LIVE SELECT queries to receive notifications for records that SELECT permission expressions should have hidden.

🔗 References (4)

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6wqw-vhfr-9999
https://nvd.nist.gov/vuln/detail/CVE-2026-63749
https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-live-select
https://github.com/advisories/GHSA-75qw-w395-xvv7