Executive brief
SurrealDB is a database platform that allows authenticated users to switch between databases during a session. A flaw in the authentication validation allows an already-logged-in user to impersonate a different user in another database if a user record with an identical identifier exists in that database, potentially leading to unauthorized data access or modification depending on database permissions.
Technical details
This is an improper authentication vulnerability (CWE-287) affecting SurrealDB's scope user authentication mechanism. When an authenticated scope user switches databases using the USE clause or use method, the system fails to re-validate authentication against the target database. If the target database contains a user record with an identical identifier to the authenticated user's record in the source database, the attacker can perform operations under the impersonated user's identity. The vulnerability requires an authenticated session and relies on matching record identifiers across databases; it is mitigated when PERMISSIONS clauses explicitly check the $scope parameter or contain database-specific checks beyond relying solely on $auth. Patches are available in SurrealDB 1.5.4, 2.0.0-alpha.6, and surrealdb-core 1.5.1.
Affected products
- SurrealDB SurrealDB <= 1.5.3
- SurrealDB SurrealDB <= 2.0.0-alpha.5
- SurrealDB surrealdb-core <= 1.5.0
Timeline
- 2024-07-10: disclosed: Original advisory GHSA-gh9f-6xm2-c4j2 published
- 2024: patched: Fixed in SurrealDB 1.5.4, 2.0.0-alpha.6, and surrealdb-core 1.5.1
- 2026-07-18: advisory: Duplicate advisory GHSA-hgp5-pm7v-q8vg published (CVE-2024-58363)
- 2026-09-04: other: GHSA-hgp5-pm7v-q8vg withdrawn as duplicate