CVE-2024-58367 json
SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions
published 2024-10-08 2 y ago modified 2026-10-27 12 d ago also GHSA-9722-9j67-vjcr , EUVD-2024-55683
- cvss
- 6.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references to leak protected field contents despite lacking SELECT permissions.
Patch / fix
- crates.io surrealdb 2.0.4
- crates.io surrealdb-core 2.0.4
- surrealdb surrealdb 2.0.4
- github.com/surrealdb/surrealdb@439ab99 commit
- github.com/surrealdb/surrealdb@c382fa1 commit
- github.com/surrealdb/surrealdb@e75e773 commit
- github.com/surrealdb/surrealdb#4785 pull request
- github.com/surrealdb/surrealdb#4800 pull request
- github.com/surrealdb/surrealdb#4873 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 3 mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | surrealdb | <2.0.4 |
2.0.4 |
| crates.io | surrealdb-core | <2.0.4 |
2.0.4 |
Affected products
- surrealdb surrealdb
Classification
- Weakness
-
- CWE-285 Improper Authorization
References
-
github.com
/surrealdb/surrealdb/pull/4785
web
-
github.com
/surrealdb/surrealdb/pull/4800
web
-
github.com
/surrealdb/surrealdb/pull/4873
web
-
github.com
/surrealdb/surrealdb/commit/439ab99e15314ec5cf87047bf58246db646e3f8c
web
-
github.com
/surrealdb/surrealdb/commit/c382fa158dc84b329328606f663efe574f102a7d
web
-
github.com
/surrealdb/surrealdb/commit/e75e7736b3a028c4b6a4a4bdf00791d76f77e339
web
-
github.com
/surrealdb/surrealdb/security/advisories/GHSA-9722-9j67-vjcr
vendor-advisory, web
-
vulncheck.com
/advisories/surrealdb-before-improper-authorization-via-select-permissions
third-party-advisory, web
-
nvd.nist.gov
/vuln/detail/CVE-2024-58367
advisory
-
github.com
/surrealdb/surrealdb/issues/2161
web
-
github.com
/surrealdb/surrealdb/issues/3924
web
-
github.com
/surrealdb/surrealdb
package
-
surrealdb.com
/docs/surrealdb/security/summary#permissions
web
-
surrealdb.com
/docs/surrealql/statements/define/field#setting-permissions-on-fields
web
-
surrealdb.com
/docs/surrealql/statements/define/table#defining-permissions
web
Sources
- CVE List CVE-2024-58367
- GitHub Advisory GHSA-9722-9j67-vjcr
- NVD CVE-2024-58367
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.