CVE-2024-58363: SurrealDB improper authentication during database switch

CVE-2024-58363 · Severity: medium · CVSS 6.3 · Published 2026-07-18

SurrealDB is a multi-model database designed for modern web applications. A security flaw allows an already logged-in user to switch to a different database within the same system and potentially impersonate another user. This could allow an attacker to view or modify data they should not have access to, provided the target user has a matching ID in the second database.

Technologies: surrealdb (crates.io), surrealdb-core (crates.io), Surrealdb-Core. Vendors: crates.io, SurrealDB.

Quick answers

Is CVE-2024-58363 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-58363 being exploited in the wild.
How severe is CVE-2024-58363?
Medium severity, with a CVSS score of 6.3, published 18 July 2026.
Which products and versions are affected?
surrealdb (crates.io) SEMVER:introduced=0,fixed=1.5.4; surrealdb-core (crates.io) SEMVER:introduced=0,fixed=1.5.1; Surrealdb-Core < 1.5.1.
Is there a fix for CVE-2024-58363?
Yes. surrealdb (crates.io): upgrade to 1.5.4 or later; surrealdb-core (crates.io): upgrade to 1.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-58363 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2024-58363?
Check whether you run surrealdb (crates.io), surrealdb-core (crates.io) or Surrealdb-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • surrealdb (crates.io): upgrade to 1.5.4 or later
    cargo update -p surrealdb
  • surrealdb-core (crates.io): upgrade to 1.5.1 or later
    cargo update -p surrealdb-core

Technical details

An improper authentication vulnerability exists in SurrealDB when a 'scope user' switches working databases within an active session using the USE clause or .use() method. The root cause is a failure to re-validate the user's identity against the new database's context. If a user record in the target database shares an identical record identifier with the authenticated user from the original database, the session may incorrectly map to that unrelated identity. An attacker with network access and valid low-privileged credentials can exploit this to perform unauthorized actions if the database's PERMISSIONS clauses rely solely on the $auth parameter. The issue is mitigated if record IDs are randomly generated (the default) or if permissions check for specific scopes or token claims. Patches are available in versions 1.5.4, 2.0.0-alpha.6, and 1.5.1 (core).

Affected products

  • SurrealDB surrealdb < 1.5.4, < 2.0.0-alpha.6
  • SurrealDB surrealdb-core < 1.5.1

Identifiers

  • CVE-2024-58363
  • GHSA-gh9f-6xm2-c4j2

Timeline

  • 2024-07-10: advisory: Original GitHub Security Advisory published
  • 2024-07-10: patched: Fixes released in versions 1.5.4 and 2.0.0-alpha.6
  • 2026-07-18: disclosed: CVE-2024-58363 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.