CVE-2024-58356
SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.
| CWE | CWE-276 |
| Vendor | surrealdb |
| Product | surrealdb |
| Published | Jul 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for surrealdb surrealdb
Be the first to know when new unknown vulnerabilities affecting surrealdb surrealdb are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
surrealdb / surrealdb
0 < 2.1.4
surrealdb / surrealdb
0 < 2.1.4
References
Credits
🔍 AlbertMarashi