Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.3, published 18 July 2026.

Which products and versions are affected?

surrealdb (crates.io) <= 1.5.3; Surrealdb-Core <= 1.5.0.

Is there a fix for This vulnerability?

A patch was published on 2024: Fixed in SurrealDB 1.5.4, 2.0.0-alpha.6, and surrealdb-core 1.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run surrealdb (crates.io) or Surrealdb-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

SurrealDB authentication bypass when changing databases as scope user

Q: Is there a fix for This vulnerability?

A patch was published on 2024: Fixed in SurrealDB 1.5.4, 2.0.0-alpha.6, and surrealdb-core 1.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is This vulnerability attacked?

It is attacked over the network, in a software library.

Q: Am I affected?

Check whether you run surrealdb (crates.io) or Surrealdb-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Severity: medium · CVSS 6.3 · Published 2026-07-18

SurrealDB is a database platform that allows authenticated users to switch between databases during a session. A flaw in the authentication validation allows an already-logged-in user to impersonate a different user in another database if a user record with an identical identifier exists in that database, potentially leading to unauthorized data access or modification depending on database permissions.

Technologies: surrealdb (crates.io), Surrealdb-Core. Vendors: crates.io, SurrealDB.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.3, published 18 July 2026.
Which products and versions are affected?: surrealdb (crates.io) <= 1.5.3; Surrealdb-Core <= 1.5.0.
Is there a fix for This vulnerability?: A patch was published on 2024: Fixed in SurrealDB 1.5.4, 2.0.0-alpha.6, and surrealdb-core 1.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run surrealdb (crates.io) or Surrealdb-Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is an improper authentication vulnerability (CWE-287) affecting SurrealDB's scope user authentication mechanism. When an authenticated scope user switches databases using the USE clause or use method, the system fails to re-validate authentication against the target database. If the target database contains a user record with an identical identifier to the authenticated user's record in the source database, the attacker can perform operations under the impersonated user's identity. The vulnerability requires an authenticated session and relies on matching record identifiers across databases; it is mitigated when PERMISSIONS clauses explicitly check the $scope parameter or contain database-specific checks beyond relying solely on $auth. Patches are available in SurrealDB 1.5.4, 2.0.0-alpha.6, and surrealdb-core 1.5.1.

Affected products

SurrealDB SurrealDB <= 1.5.3
SurrealDB SurrealDB <= 2.0.0-alpha.5
SurrealDB surrealdb-core <= 1.5.0

Timeline

2024-07-10: disclosed: Original advisory GHSA-gh9f-6xm2-c4j2 published
2024: patched: Fixed in SurrealDB 1.5.4, 2.0.0-alpha.6, and surrealdb-core 1.5.1
2026-07-18: advisory: Duplicate advisory GHSA-hgp5-pm7v-q8vg published (CVE-2024-58363)
2026-09-04: other: GHSA-hgp5-pm7v-q8vg withdrawn as duplicate

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.