# CVE-2024-58367: SurrealDB improper authorization in field permissions

Source: https://junglewise.ai/threats/cve-2024-58367-surrealdb-improper-authorization-in-field-permissions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-18. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-58367 · Severity: medium · CVSS 6.5 · Published 2026-07-18

SurrealDB is a multi-model database engine commonly used in backend-as-a-service deployments. A flaw in how the database enforces field-level and table-level permissions allows authenticated users with limited access (e.g., SELECT on a table but not on specific fields) to read restricted field values through various query techniques including aliasing, function calls, filtering, and UPDATE/DELETE operations. This affects deployments relying on SurrealDB's permission system to protect sensitive data from application users.

Technologies: [surrealdb (crates.io)](https://junglewise.ai/threats/technologies/surrealdb), [surrealdb-core (crates.io)](https://junglewise.ai/threats/technologies/crates-io-surrealdb-core), [Surrealdb-Core](https://junglewise.ai/threats/technologies/surrealdb-core). Vendors: [crates.io](https://junglewise.ai/threats/vendors/crates-io), [SurrealDB](https://junglewise.ai/threats/vendors/surrealdb).

## Quick answers

**Is CVE-2024-58367 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-58367 being exploited in the wild.

**How severe is CVE-2024-58367?** Medium severity, with a CVSS score of 6.5, published 18 July 2026.

**Which products and versions are affected?** surrealdb (crates.io) < 2.0.4, SEMVER:introduced=0,fixed=2.0.4; surrealdb-core (crates.io) SEMVER:introduced=0,fixed=2.0.4; Surrealdb-Core < 2.0.4.

**Is there a fix for CVE-2024-58367?** Yes. surrealdb (crates.io): upgrade to 2.0.4 or later; surrealdb-core (crates.io): upgrade to 2.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-58367 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-58367?** Check whether you run surrealdb (crates.io), surrealdb-core (crates.io) or Surrealdb-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- surrealdb (crates.io): upgrade to 2.0.4 or later

  ```sh
  cargo update -p surrealdb
  ```

- surrealdb-core (crates.io): upgrade to 2.0.4 or later

  ```sh
  cargo update -p surrealdb-core
  ```


## Technical details

The vulnerability stems from improper permission evaluation ordering in SurrealDB's query processing. Affected versions (before 2.0.4) check field-level SELECT permissions after applying query transformations rather than before. This allows six distinct attack patterns: (1) SELECT VALUE operations bypass field filtering for non-iterable values; (2) field aliasing causes permission checks to apply to the aliased name instead of the original field; (3) functions passed protected field values receive them before permission filtering; (4) WHERE clauses on restricted fields leak information via side-channel filtering; (5) DELETE/UPDATE with RETURN BEFORE bypasses SELECT permission requirements; (6) UPDATE SET clauses can reference fields with UPDATE but not SELECT permission. The root cause is that permissions were evaluated on modified documents rather than original ones. The vulnerability requires the attacker to already be authenticated with some query privileges on the affected table or field. Version 2.0.4 and later fix this by evaluating permissions before document modifications occur.

## Affected products

- SurrealDB surrealdb < 2.0.4
- SurrealDB surrealdb-core < 2.0.4

## Identifiers

- CVE-2024-58367
- GHSA-9722-9j67-vjcr

## Timeline

- 2024-10-08: disclosed
- 2024-10-08: patched: Version 2.0.4 released with fixes

## References

- [https://api.github.com/users/5hanth](https://api.github.com/users/5hanth)
- [https://github.com/5hanth](https://github.com/5hanth)
- [https://api.github.com/users/5hanth/gists%7B/gist_id%7D](https://api.github.com/users/5hanth/gists%7B/gist_id%7D)
- [https://api.github.com/users/5hanth/repos](https://api.github.com/users/5hanth/repos)
- [https://avatars.githubusercontent.com/u/4287700?v=4](https://avatars.githubusercontent.com/u/4287700?v=4)
- [https://api.github.com/users/5hanth/events%7B/privacy%7D](https://api.github.com/users/5hanth/events%7B/privacy%7D)

## Related threats

- [SurrealDB use-after-free in KV backends via affinitypool spawn_local](https://junglewise.ai/threats/cve-2026-121417-surrealdb-before-3-3-0-contains-a-use-after-free-vulnerability)
- [RUSTSEC-2026-0454 - Data race and double free via unsound `Send`/`Sync` in `reblessive`](https://junglewise.ai/threats/rustsec-2026-0454-data-race-and-double-free-via-unsound-send-sync-in-b23614bb)
- [SurrealDB JSON parser denial of service via uncontrolled recursion](https://junglewise.ai/threats/surrealdb-json-parser-denial-of-service-via-uncontrolled-recursion-3037f8a0)
- [SurrealDB ES512 algorithm silently downgraded to ES384](https://junglewise.ai/threats/surrealdb-es512-algorithm-silently-downgraded-to-es384-f0af29b8)
- [SurrealDB permission bypass via WHERE clause evaluation](https://junglewise.ai/threats/surrealdb-permission-bypass-via-where-clause-evaluation-afa6f001)