CVE-2024-58356

MediumCVSS 6.3/10Last modified Aug 12, 2026

Description

SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published
Jul 18, 2026
Last modified
Aug 12, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-583576.5SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called oCVE-2024-583584.9SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define usCVE-2024-583596.5SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. AuthorCVE-2024-58368.8Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who convinced a user to install a malicCVE-2024-583606.5stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and sCVE-2024-583616.5SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing emptCVE-2024-583628.8SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API wCVE-2024-583636.3SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. AtCVE-2024-583646.5SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on lCVE-2024-583656.5SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent builtCVE-2024-583668.8SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. AttaCVE-2024-583676.5SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized