SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.
CVE-2024-58363
CVSS base score
6.3 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-287
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Affected products
surrealdb surrealdb
References
- github.com Vendor Advisory
- www.vulncheck.com Third Party Advisory