CVE-2024-58356

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-58356
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58356.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-58356
Aliases
Published
2026-07-18T13:10:00Z
Modified
2026-08-14T04:03:18Z
Severity
  • 2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE
Details

SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-276"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/58xxx/CVE-2024-58356.json"
}
References

Affected packages

Git / github.com/surrealdb/surrealdb

Affected ranges

Type
GIT
Repo
https://github.com/surrealdb/surrealdb
Events
Introduced
c382fa158dc84b329328606f663efe574f102a7d
Fixed
bf0bb36950415a7dcee300063839a3c6a22241c1
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.4"
        },
        {
            "introduced": "2.0.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.1.0
v2.1.1
v2.1.2
v2.1.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-58356.json"