CVE-2024-58356: SurrealDB incorrect permission application in DEFINE TABLE OVERWRITE

CVE-2024-58356 · Severity: medium · CVSS 4 · Published 2026-07-18

SurrealDB is a multi-model database platform. A bug in the `DEFINE TABLE` statement's `OVERWRITE` clause prevents permission updates from taking effect when applied to tables defined with `TYPE RELATION`. This allows authenticated users with query access to retain or gain access to data they should not be able to read after an administrator attempts to restrict permissions on such tables.

Technologies: surrealdb (crates.io), surrealdb-core (crates.io), Surrealdb-Core. Vendors: crates.io, SurrealDB.

Quick answers

Is CVE-2024-58356 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-58356 being exploited in the wild.
How severe is CVE-2024-58356?
Medium severity, with a CVSS score of 4, published 18 July 2026.
Which products and versions are affected?
surrealdb (crates.io) >= 2.0.0, < 2.1.4, SEMVER:introduced=2.0.0,fixed=2.1.4; surrealdb-core (crates.io) SEMVER:introduced=2.0.0,fixed=2.1.4; Surrealdb-Core >= 2.0.0, < 2.1.4, 2.0.0 to 2.1.3.
Is there a fix for CVE-2024-58356?
Yes. surrealdb (crates.io): upgrade to 2.1.4 or later; surrealdb-core (crates.io): upgrade to 2.1.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-58356 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-58356?
Check whether you run surrealdb (crates.io), surrealdb-core (crates.io) or Surrealdb-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • surrealdb (crates.io): upgrade to 2.1.4 or later
    cargo update -p surrealdb
  • surrealdb-core (crates.io): upgrade to 2.1.4 or later
    cargo update -p surrealdb-core

Technical details

The vulnerability is an authorization bypass caused by incorrect permission assignment (CWE-732) in SurrealDB's `DEFINE TABLE` statement. When a user attempts to update table permissions for a relation-type table using the `OVERWRITE` clause, the operation silently fails to apply the new permissions while appearing to succeed. The vulnerable component is the table definition logic, affecting versions 2.0.0 through 2.1.3. Exploitation requires network access to a SurrealDB server and valid query credentials, making this a low-complexity attack with low privilege requirements. An authenticated attacker can exploit this to access or retain access to data in a relation-type table after permissions were intended to be revoked. The issue is patched in version 2.1.4 and later via fix #5260; affected users who cannot upgrade must delete and recreate the table definition from scratch.

Affected products

  • SurrealDB SurrealDB 2.0.0 to 2.1.3
  • SurrealDB surrealdb-core 2.0.0 to 2.1.3

Identifiers

  • CVE-2024-58356
  • GHSA-27vq-hv74-7cqp

Timeline

  • 2024-12-16: disclosed: GHSA-27vq-hv74-7cqp published
  • 2024-12-16: patched: Fix available in version 2.1.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.