CVE-2024-58356
SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE
- State
- Published
- Severity
- 2.3 Low
- Published
- Jul 18, 2026
- Updated
- Jul 28, 2026
- Reserved
- Jun 8, 2026
Description
SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 2.3 Low | CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-276 Incorrect Default Permissions
Affected Products
| Product | Versions |
|---|---|
surrealdbsurrealdb |
|
surrealdbsurrealdb |
|
References
- GitHub Security Advisory (GHSA-27vq-hv74-7cqp)vendor-advisory
- VulnCheck Advisory: SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITEthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.