Medium severity6.3NVD Advisory· Published Jul 18, 2026· Updated Aug 12, 2026
CVE-2024-58363
CVE-2024-58363
Description
SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*+ 6 more
- cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*range: <1.5.4
- cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha4:*:*:*:*:*:*
- cpe:2.3:a:surrealdb:surrealdb:2.0.0:alpha5:*:*:*:*:*:*
- (no CPE)range: <1.5.4
Patches
Vulnerability mechanics
References
2- github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2nvdVendor Advisory
- www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switchnvdThird Party Advisory
News mentions
0No linked articles in our index yet.