CVE-2024-58358

MediumCVSS 4.9/10Last modified Aug 12, 2026

Description

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-248

Affected software

No affected versions have been published.

Timeline

Published
Jul 18, 2026
Last modified
Aug 12, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-583596.5SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. AuthorCVE-2024-58368.8Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who convinced a user to install a malicCVE-2024-583606.5stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and sCVE-2024-583616.5SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing emptCVE-2024-583628.8SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API wCVE-2024-583636.3SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. AtCVE-2024-583646.5SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on lCVE-2024-583656.5SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent builtCVE-2024-583668.8SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. AttaCVE-2024-583676.5SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorizedCVE-2024-583687.5SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. UCVE-2024-583696.5SurrealDB versions before 1.1.1 fail to properly validate invocation of custom parameters and functions at root or namespace levels, causing
CVE-2024-58358: Medium severity, CVSS 4.9 | Vulnix