{"action":"Upgrade surrealdb to 3.1.0 or later.","affected":[{"fixed":"3.1.0","introduced":"0"}],"component":"surrealdb","cve_ids":[],"ecosystem":"crates.io","exploited":false,"fixed_versions":["3.1.0"],"ghsa_id":"GHSA-5qfp-32cf-69jh","id":"tcs_01M5KET67YAWYGVFTTTX7C0VN5","modified_at":"2026-07-01T20:15:09.916892176Z","published_at":"2026-07-01T20:00:17Z","references":["https://osv.dev/vulnerability/GHSA-5qfp-32cf-69jh","https://github.com/surrealdb/surrealdb/security/advisories/GHSA-5qfp-32cf-69jh","https://github.com/surrealdb/surrealdb/commit/fd800fc7c55afcdc97057d18cf7cb7f83557e702","https://github.com/surrealdb/surrealdb"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-5qfp-32cf-69jh","url":"https://osv.dev/vulnerability/GHSA-5qfp-32cf-69jh"}],"summary":"SurrealDB: HTTP /rpc `sessions` method leaks attached session UUIDs, enabling full session hijack by anonymous callers"}