CVE-2024-58356

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-58356", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-06-08T15:20:35.497Z", "datePublished": "2026-07-18T13:10:00.884Z", "dateUpdated": "2026-07-28T01:47:46.525Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:47:46.525Z"}, "datePublic": "2024-12-16T00:00:00.000Z", "title": "SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE", "descriptions": [{"lang": "en", "value": "SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Incorrect Default Permissions", "cweId": "CWE-276", "type": "CWE"}]}], "affected": [{"vendor": "surrealdb", "product": "surrealdb", "defaultStatus": "unaffected", "packageURL": "pkg:cargo/surrealdb", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "2.1.4"}, {"version": "2.1.4", "status": "unaffected", "versionType": "semver"}]}, {"vendor": "surrealdb", "product": "surrealdb", "defaultStatus": "unaffected", "packageURL": "pkg:cargo/surrealdb-core", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "2.1.4"}, {"version": "2.1.4", "status": "unaffected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "versionEndExcluding": "2.1.4"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 2.3, "baseSeverity": "LOW"}}], "references": [{"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-27vq-hv74-7cqp", "name": "GitHub Security Advisory (GHSA-27vq-hv74-7cqp)", "tags": ["vendor-advisory"]}, {"name": "VulnCheck Advisory: SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-define-table-overwrite"}], "credits": [{"lang": "en", "value": "AlbertMarashi", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-20T19:23:39.284384Z", "id": "CVE-2024-58356", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:32:01.405Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-58356", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-20T19:23:39.284384Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-20T19:23:40.001Z"}}], "cna": {"title": "SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE", "credits": [{"lang": "en", "type": "reporter", "value": "AlbertMarashi"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 2.3, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "0", "lessThan": "2.1.4", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.4", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb", "defaultStatus": "unaffected"}, {"vendor": "surrealdb", "product": "surrealdb", "versions": [{"status": "affected", "version": "0", "lessThan": "2.1.4", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.4", "versionType": "semver"}], "packageURL": "pkg:cargo/surrealdb-core", "defaultStatus": "unaffected"}], "datePublic": "2024-12-16T00:00:00.000Z", "references": [{"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-27vq-hv74-7cqp", "name": "GitHub Security Advisory (GHSA-27vq-hv74-7cqp)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-define-table-overwrite", "name": "VulnCheck Advisory: SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "Incorrect Default Permissions"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "2.1.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-07-28T01:47:46.525Z"}}}, "cveMetadata": {"cveId": "CVE-2024-58356", "state": "PUBLISHED", "dateUpdated": "2026-07-28T01:47:46.525Z", "dateReserved": "2026-06-08T15:20:35.497Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-07-18T13:10:00.884Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:cargo/surrealdb", "product": "surrealdb", "vendor": "surrealdb", "versions": [{"lessThan": "2.1.4", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.4", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:cargo/surrealdb-core", "product": "surrealdb", "vendor": "surrealdb", "versions": [{"lessThan": "2.1.4", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "2.1.4", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1F3DC53-29A9-445D-BEA9-95C2D259DCF5", "versionEndExcluding": "2.1.4", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict."}, {"lang": "es", "value": "SurrealDB anterior a la versi\u00f3n 2.1.4 falla silenciosamente al sobrescribir definiciones de tabla cuando se utiliza la cl\u00e1usula DEFINE TABLE ... OVERWRITE en tablas definidas con TYPE RELATION. Debido a que las definiciones de tabla incluyen la cl\u00e1usula PERMISSIONS, un intento de restringir los permisos de una tabla a trav\u00e9s de OVERWRITE no surte efecto, y el administrador puede creer incorrectamente que el cambio se aplic\u00f3. Como resultado, un cliente autorizado para ejecutar consultas puede continuar accediendo a datos en esa tabla que los permisos actualizados (pero no aplicados) estaban destinados a restringir."}], "id": "CVE-2024-58356", "lastModified": "2026-10-27T18:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-58356", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-20T19:23:39.284384Z", "version": "2.0.3"}}]}, "published": "2026-07-18T14:17:08.363", "references": [{"source": "disclosure@vulncheck.com", "tags": ["Vendor Advisory"], "url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-27vq-hv74-7cqp"}, {"source": "disclosure@vulncheck.com", "tags": ["Third Party Advisory"], "url": "https://www.vulncheck.com/advisories/surrealdb-before-permission-bypass-via-define-table-overwrite"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.1.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.1.4"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "surrealdb", "source": "cna", "vendor": "surrealdb"}, "product": "surrealdb", "vendor": "surrealdb"}], "created": "2026-07-22T19:45:17.007757+00:00", "updated": "2026-07-30T23:15:06.065104+00:00", "vendors": ["surrealdb", "surrealdb$PRODUCT$surrealdb"]}