# GHSA-4m82-p8cx-f94j: SurrealDB: LIVE query subscriptions survive session state changes, bypassing access controls

> Attackers with valid sessions can retain read access to data after logout or session expiry via stale LIVE query subscriptions, bypassing access control updates.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 1 Jul 2026

## What is GHSA-4m82-p8cx-f94j?

GHSA-4m82-p8cx-f94j is a vulnerability in surrealdb, published on 1 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

A `LIVE SELECT` subscription records the user's auth state (`$auth`, `$token`, `$session`, `$access`) when it is registered, and the server uses that recorded state to evaluate the table- and row-level `PERMISSIONS` clauses for every subsequent notification. The recorded state is never refreshed. 

When something changes the user's effective auth state — the originating session is invalidated, the session's TTL expires, or the user signs in, signs up, or authenticates as a different identity on the same connection — the subscription keeps delivering notifications under the old, stale auth state, and the `PERMISSIONS` that should now apply to the connection are never consulted.

### Impact

A user whose session has been revoked, expired, signed out of, or re-authenticated on the same connection continues to receive real-time notifications evaluated against the prior principal. The attacker does not gain access to new resources — only continued access to resources the prior principal was already permitted to read — but that continued access persists past the point the principal change should have ended it, and persists indefinitely until the originating connection is closed.

This is confidentiality-only: the dispatcher does not enable writes evaluated under the stranded principal.

### Patches

- **`invalidate()` and TTL expiry** — `RpcProtocol::invalidate` now calls `cleanup_lqs(session_id)` after clearing the session, dropping every LIVE owned by the now-invalidated session. The notification dispatcher additionally reads the originating session's `exp` and skips delivery once it has passed, closing the TTL-expiry leg without requiring the `Session` object to remain in memory.
- **Principal change on `signin` / `signup` / `authenticate` / `refresh`** — each of these RPC methods now snapshots the session's auth principal (`Auth::id()` + `Auth::level()`) before mutating the session and, if the principal has changed after the operation, calls `cleanup_lqs(session_id)`. Token refresh against the same identity is therefore preserved; identity change tears stranded subscriptions down.

Versions  3.1.0 and later are not affected by this issue.

### Workarounds

For unpatched versions, clients should call `reset()` (which tears down all LIVE queries owned by the session) or `kill` each outstanding `live query ID` before signing out, signing in as a different identity, or signing up on an existing connection. There is no client-side workaround for the TTL-expiry leg; deployments concerned about it should restrict `DURATION FOR SESSION` on access methods that have permission to register LIVE queries.

## Which versions are affected by GHSA-4m82-p8cx-f94j?

2 open source packages ship an affected version, including surrealdb.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `surrealdb` | crates.io | All versions | 3.1.0 |
| `surrealdb` | crates.io | All versions | 3.1.0 |

## How do I fix GHSA-4m82-p8cx-f94j?

Upgrade surrealdb to 3.1.0 or later.

## Is GHSA-4m82-p8cx-f94j being exploited?

There is no known exploitation of GHSA-4m82-p8cx-f94j in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-4m82-p8cx-f94j and fix it if it is affected.

What it is: GHSA-4m82-p8cx-f94j is a vulnerability in surrealdb, published on 1 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of GHSA-4m82-p8cx-f94j in the wild and no public exploit code.

Affected packages and fixed versions:
- surrealdb (crates.io): affected all versions; fixed in 3.1.0
- surrealdb (crates.io): affected all versions; fixed in 3.1.0

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-4m82-p8cx-f94j/ (Markdown: https://insights.sbomify.com/GHSA-4m82-p8cx-f94j/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-4m82-p8cx-f94j

---
From sbomify Insights: https://insights.sbomify.com/GHSA-4m82-p8cx-f94j/
Summaries are generated and may contain mistakes; the official description above is the record.