CVE-2024-58363 Details
Description
SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.
A vulnerability exists in SurrealDB versions prior to 1.5.4 and 2.0.0-alpha.6, where the database authentication process is not properly validated when a scope user switches databases using the 'USE' clause or method. This flaw allows attackers with an authenticated session to impersonate an unrelated user in a different database, provided a user record with the same identifier exists. Such impersonation could enable unauthorized actions if the user's permissions are solely based on the $auth parameter.
Users can update to SurrealDB version 1.5.4 or 2.0.0-alpha.6 or later, where this vulnerability has been patched. For those unable to update, it is recommended to ensure that table 'PERMISSIONS' clauses explicitly check that the $scope parameter matches a scope that is uniquely named across databases in the same SurrealDB instance. Additionally, using record identifiers that are automatically generated or explicitly defined to be unique across databases can help mitigate this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2 | [email protected] | Vendor Advisory |
| https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| surrealdb surrealdb | < 1.5.4 2.0.0 alpha1 2.0.0 alpha2 2.0.0 alpha3 2.0.0 alpha4 2.0.0 alpha5 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 20, 2026 | CVE Modified | CISA-ADP |
| Jul 18, 2026 | New CVE Received | [email protected] |