CVE-2024-58367

SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references to leak protected field contents despite lacking SELECT permissions.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-9722-9j67-vjcr	Vendor Advisory
https://www.vulncheck.com/advisories/surrealdb-before-improper-authorization-via-select-permissions	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*

History

27 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de SurrealDB anteriores a la 2.0.4 no aplican correctamente los permisos de campo durante las operaciones SELECT, UPDATE y DELETE, permitiendo a usuarios autorizados acceder a valores de campo no autorizados a través de diversas técnicas de consulta. Los atacantes pueden explotar operaciones SELECT VALUE, alias de campo, argumentos de función, filtrado de cláusulas WHERE, cláusulas RETURN BEFORE y referencias de cláusulas SET para filtrar contenido de campos protegidos a pesar de carecer de permisos SELECT.

Information

Published : 2026-07-18 14:17

Updated : 2026-10-27 18:10

NVD link : CVE-2024-58367

Mitre link : CVE-2024-58367

CVE.ORG link : CVE-2024-58367

JSON object : View

Products Affected

surrealdb

surrealdb

CWE

CWE-285

Improper Authorization

{"id": "CVE-2024-58367", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58367", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-21T02:37:44.863726Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.4", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.4", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb", "defaultStatus": "unaffected"}, {"vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "0", "lessThan": "2.0.4", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.4", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb-core", "defaultStatus": "unaffected"}]}], "published": "2026-07-18T14:17:09.737", "references": [{"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-9722-9j67-vjcr", "tags": ["Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/surrealdb-before-improper-authorization-via-select-permissions", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references to leak protected field contents despite lacking SELECT permissions."}, {"lang": "es", "value": "Las versiones de SurrealDB anteriores a la 2.0.4 no aplican correctamente los permisos de campo durante las operaciones SELECT, UPDATE y DELETE, permitiendo a usuarios autorizados acceder a valores de campo no autorizados a trav\u00e9s de diversas t\u00e9cnicas de consulta. Los atacantes pueden explotar operaciones SELECT VALUE, alias de campo, argumentos de funci\u00f3n, filtrado de cl\u00e1usulas WHERE, cl\u00e1usulas RETURN BEFORE y referencias de cl\u00e1usulas SET para filtrar contenido de campos protegidos a pesar de carecer de permisos SELECT."}], "lastModified": "2026-10-27T18:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BE39873-267E-489F-A1F8-F56218E85E38", "versionEndExcluding": "2.0.4"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}