PT-2026-60936 · Surrealdb · Surrealdb

Lucyegan · CVE-2023-54366 · Published 2026-07-18 · Updated 2026-07-18

Mitre

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations on unprotected tables within their authorization scope.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2023-54366

Affected Products

Surrealdb

References · 3

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x5fr-7hhj-34j3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-54366 · Security Note
• https://vulncheck.com/advisories/surrealdb-before-insecure-default-table-permissions · Note