CVE-2024-58356 json
SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE
published 2024-12-16 22 mo ago modified 2026-10-27 12 d ago also GHSA-27vq-hv74-7cqp , EUVD-2024-55673
- cvss
- 6.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.
Patch / fix
- crates.io surrealdb 2.1.4
- crates.io surrealdb-core 2.1.4
- surrealdb surrealdb 2.1.4
- github.com/surrealdb/surrealdb@2f9a58f commit
- github.com/surrealdb/surrealdb#5260 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 2.3 | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | surrealdb | >=2.0.0, <2.1.4 |
2.1.4 |
| crates.io | surrealdb-core | >=2.0.0, <2.1.4 |
2.1.4 |
Affected products
- surrealdb surrealdb
Classification
References
-
github.com
/surrealdb/surrealdb/pull/5260
web
-
github.com
/surrealdb/surrealdb/commit/2f9a58f830c24f107b4783da1f0704a502bc7734
web
-
github.com
/surrealdb/surrealdb/security/advisories/GHSA-27vq-hv74-7cqp
vendor-advisory, web
-
vulncheck.com
/advisories/surrealdb-before-permission-bypass-via-define-table-overwrite
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2024-58356
advisory
-
github.com
/surrealdb/surrealdb
package
Sources
- CVE List CVE-2024-58356
- GitHub Advisory GHSA-27vq-hv74-7cqp
- NVD CVE-2024-58356
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.