# CVE-2024-58363: SurrealDB improper authentication during database switch

Source: https://junglewise.ai/threats/cve-2024-58363-surrealdb-improper-authentication-during-database-switch  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-18. Updated: 2026-07-18  
License: CC BY 4.0 with a link back

CVE-2024-58363 · Severity: medium · CVSS 6.3 · Published 2026-07-18

SurrealDB is a multi-model database designed for modern web applications. A security flaw allows an already logged-in user to switch to a different database within the same system and potentially impersonate another user. This could allow an attacker to view or modify data they should not have access to, provided the target user has a matching ID in the second database.

Technologies: [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb), [surrealdb-core (crates.io)](https://junglewise.ai/threats/technologies/crates-io-surrealdb-core), [Surrealdb-Core](https://junglewise.ai/threats/technologies/surrealdb-core). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [SurrealDB](https://junglewise.ai/threats/vendors/surrealdb).

## Quick answers

**Is CVE-2024-58363 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-58363 being exploited in the wild.

**How severe is CVE-2024-58363?** Medium severity, with a CVSS score of 6.3, published 18 July 2026.

**Which products and versions are affected?** surrealdb (crates.io) SEMVER:introduced=0,fixed=1.5.4; surrealdb-core (crates.io) SEMVER:introduced=0,fixed=1.5.1; Surrealdb-Core < 1.5.1.

**Is there a fix for CVE-2024-58363?** Yes. surrealdb (crates.io): upgrade to 1.5.4 or later; surrealdb-core (crates.io): upgrade to 1.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-58363 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-58363?** Check whether you run surrealdb (crates.io), surrealdb-core (crates.io) or Surrealdb-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- surrealdb (crates.io): upgrade to 1.5.4 or later

  ```sh
  cargo update -p surrealdb
  ```

- surrealdb-core (crates.io): upgrade to 1.5.1 or later

  ```sh
  cargo update -p surrealdb-core
  ```


## Technical details

An improper authentication vulnerability exists in SurrealDB when a 'scope user' switches working databases within an active session using the USE clause or .use() method. The root cause is a failure to re-validate the user's identity against the new database's context. If a user record in the target database shares an identical record identifier with the authenticated user from the original database, the session may incorrectly map to that unrelated identity. An attacker with network access and valid low-privileged credentials can exploit this to perform unauthorized actions if the database's PERMISSIONS clauses rely solely on the $auth parameter. The issue is mitigated if record IDs are randomly generated (the default) or if permissions check for specific scopes or token claims. Patches are available in versions 1.5.4, 2.0.0-alpha.6, and 1.5.1 (core).

## Affected products

- SurrealDB surrealdb < 1.5.4, < 2.0.0-alpha.6
- SurrealDB surrealdb-core < 1.5.1

## Identifiers

- CVE-2024-58363
- GHSA-gh9f-6xm2-c4j2

## Timeline

- 2024-07-10: advisory: Original GitHub Security Advisory published
- 2024-07-10: patched: Fixes released in versions 1.5.4 and 2.0.0-alpha.6
- 2026-07-18: disclosed: CVE-2024-58363 published to NVD

## References

- [https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2](https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2)
- [https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch](https://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch)

## Related threats

- [SurrealDB use-after-free in KV backends via affinitypool spawn_local](https://junglewise.ai/threats/cve-2026-121417-surrealdb-before-3-3-0-contains-a-use-after-free-vulnerability)
- [RUSTSEC-2026-0454 - Data race and double free via unsound `Send`/`Sync` in `reblessive`](https://junglewise.ai/threats/rustsec-2026-0454-data-race-and-double-free-via-unsound-send-sync-in-b23614bb)
- [SurrealDB JSON parser denial of service via uncontrolled recursion](https://junglewise.ai/threats/surrealdb-json-parser-denial-of-service-via-uncontrolled-recursion-3037f8a0)
- [SurrealDB ES512 algorithm silently downgraded to ES384](https://junglewise.ai/threats/surrealdb-es512-algorithm-silently-downgraded-to-es384-f0af29b8)
- [SurrealDB permission bypass via WHERE clause evaluation](https://junglewise.ai/threats/surrealdb-permission-bypass-via-where-clause-evaluation-afa6f001)