VULNERABILITY INTELLIGENCE

CVE-2024-58363

CVSS score6.3 MEDIUM
EPSS probability0.34%
CISA KEVNot currently listed
Published2026-07-18
Last modified2026-10-29
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Description

SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.

Weakness classification

  • disclosure@vulncheck.com: CWE-287

Primary references