CVE-2024-58363: Surrealdb

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.

Affected products

• Surrealdb Surrealdb: before 1.5.4 (fixed in 1.5.4); version 2.0.0 only

Published 2026-07-18. Last modified 2026-08-12.