Medium severity6.3NVD Advisory· Published Jul 18, 2026· Updated Aug 12, 2026
CVE-2024-58356
CVE-2024-58356
Description
SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
surrealdbcrates.io | >= 2.0.0, < 2.1.4 | 2.1.4 |
surrealdb-corecrates.io | >= 2.0.0, < 2.1.4 | 2.1.4 |
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-27vq-hv74-7cqpghsaADVISORY
- github.com/surrealdb/surrealdb/security/advisories/GHSA-27vq-hv74-7cqpnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2024-58356ghsaADVISORY
- www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-define-table-overwritenvdThird Party AdvisoryWEB
- github.com/surrealdb/surrealdb/commit/2f9a58f830c24f107b4783da1f0704a502bc7734ghsaWEB
- github.com/surrealdb/surrealdb/pull/5260ghsaWEB
News mentions
0No linked articles in our index yet.