Executive brief
SurrealDB is a multi-model database designed for modern web applications. A security flaw allows an already logged-in user to switch to a different database within the same system and potentially impersonate another user. This could allow an attacker to view or modify data they should not have access to, provided the target user has a matching ID in the second database.
Technical details
An improper authentication vulnerability exists in SurrealDB when a 'scope user' switches working databases within an active session using the USE clause or .use() method. The root cause is a failure to re-validate the user's identity against the new database's context. If a user record in the target database shares an identical record identifier with the authenticated user from the original database, the session may incorrectly map to that unrelated identity. An attacker with network access and valid low-privileged credentials can exploit this to perform unauthorized actions if the database's PERMISSIONS clauses rely solely on the $auth parameter. The issue is mitigated if record IDs are randomly generated (the default) or if permissions check for specific scopes or token claims. Patches are available in versions 1.5.4, 2.0.0-alpha.6, and 1.5.1 (core).
Affected products
- SurrealDB surrealdb < 1.5.4, < 2.0.0-alpha.6
- SurrealDB surrealdb-core < 1.5.1
Timeline
- 2024-07-10: advisory: Original GitHub Security Advisory published
- 2024-07-10: patched: Fixes released in versions 1.5.4 and 2.0.0-alpha.6
- 2026-07-18: disclosed: CVE-2024-58363 published to NVD