CVE-2024-58363 — SurrealDB before 1.5.4 Authentication Bypass via Database Switch
SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session…
Published: 2026-07-18 · CVSS: 5.3 · CVSS 4.0
SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7