PT-2026-60947 · Surrealdb · Surrealdb

5Hanth + 1 · CVE-2024-58367 · Published 2026-07-18 · Updated 2026-07-18

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.0.4

Description Authorized users can bypass field permissions during SELECT, UPDATE, and DELETE operations to access unauthorized field values. This is achieved through various query techniques, including the use of SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references, which allow the leakage of protected field contents even when SELECT permissions are absent.

Recommendations Update SurrealDB to version 2.0.4 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-58367

Affected Products

Surrealdb

References · 4

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-9722-9j67-vjcr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-58367 · Security Note
• https://twitter.com/VulmonFeeds/status/2078535839819219374 · Twitter Post
• https://vulncheck.com/advisories/surrealdb-before-improper-authorization-via-select-permissions · Note