SurrealDB versions prior to 3.1.0 expose a vulnerability in the KILL statement that allows an authenticated user to terminate a LIVE SELECT subscription belonging to another user without any ownership check. An attacker can tell the database to kill a targeted live query by providing its UUID, causing the victim’s real‑time data feed to stop. The flaw is a CWE‑862 authorization bypass which can degrade service availability for affected users.

The vulnerability affects SurrealDB database software from the vendor SurrealDB. All releases earlier than version 3.1.0 are impacted.

The CVSS score of 5.3 indicates moderate risk, while the EPSS score of 0.00181 (approximately 0.18%) indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a legitimate authenticated session, and the attacker must issue a well‑formed KILL command targeting a specific live query UUID. Based on the description, it is inferred that a non‑privileged authenticated user could disrupt another user’s subscription by simply supplying that UUID.