{"items":[{"id":"NVI-00017607","kind":"vulnerability","title":"SurrealDB: HTTP RPC Session Race Condition Allows Privilege Escalation","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-4vgr-h27g-cf9p"],"plain_summary":"GitHub lists this reviewed advisory for surrealdb. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-2d74ae5870c7bb892203b09593fffb96"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-07-01T20:02:08.000Z","value":"8.1 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-2d74ae5870c7bb892203b09593fffb96"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-2d74ae5870c7bb892203b09593fffb96","url":"https://github.com/advisories/GHSA-4vgr-h27g-cf9p","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-4vgr-h27g-cf9p","publisher":"GitHub Advisory Database","observed_at":"2026-11-05T03:49:14.191Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-2d74ae5870c7bb892203b09593fffb96"],"technology":"surrealdb","known_exclusions":[],"conditions_summary":"The HTTP `/rpc` endpoint has a time-of-check/time-of-use (TOCTOU) race condition on internal session state. When authenticated and unauthenticated requests are processed concurrently, the unauthenticated request can inherit the authenticated user's session and privileges. The `/rpc` endpoint is the primary interface used by all official SurrealDB SDKs.\n\nThe HTTP `/rpc` handler does not bind each incoming request to an isolated session context. Instead, concurrent requests share mutable authentication state. When an authenticated request sets the session context and an unauthenticated request races in before it is cleared, the unauthenticated request executes with the authenticated user's privileges.\n\nThe impact depends on the privilege level of the session that is hijacked. If a root or namespace-level user session is inherited, the attacker can read and modify any data, delete records, and create persistent namespace-level users. If a scoped record user session is inherited, the attacker is limited to that user's permissions.\n\nThe attack requires no credentials, tokens, or session knowledge — only the ability to send concurrent HTTP requests to the `/rpc` endpoint while legitimate","public_affected_ranges":["< 3.1.0"]}],"null_published_at":"2026-11-05T19:10:21.425Z","source_updated_at":"2026-07-01T20:02:08.000Z","source_disclosed_at":"2026-07-01T20:02:06.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-05T03:49:14.191Z"}],"next_cursor":null,"snapshot_revision":"39771"}