CVE-2024-58356 Details
Description
SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.
A vulnerability exists in SurrealDB versions prior to 2.1.4, where the 'DEFINE TABLE ... OVERWRITE' clause fails to properly update table definitions for tables designated as 'TYPE RELATION'. This issue arises because the 'OVERWRITE' clause does not effectively modify the 'PERMISSIONS' settings for these tables. Consequently, an administrator may mistakenly believe that permission changes have been applied, while in reality, they have not. This oversight can allow clients with query authorization to access data in the table that the intended permission updates were meant to restrict.
Users can upgrade to SurrealDB version 2.1.4 or later, where this issue is fixed. For those who have already attempted to update permissions on affected tables, it is recommended to verify the current permissions using the 'INFO FOR DB' statement. If the permissions are not as intended, the table will need to be removed and redefined from scratch with the correct permissions, although data can be backed up to a temporary table before doing so.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-27vq-hv74-7cqp | [email protected] | Vendor Advisory |
| https://www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-define-table-overwrite | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-276 | Incorrect Default Permissions | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| surrealdb surrealdb | >= 2.0.0, < 2.1.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 18, 2026 | New CVE Received | [email protected] |