Dashboard / CVE-2024-58356

CVE-2024-58356

LOW
INFO Priority: 0.01 BB Relevance: 55/100
Published: 2026-07-18 Modified: 2026-10-27 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: X
AT: Present
VC: Low
VI: Low
VA: Low

Description

SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
surrealdb surrealdb 2.0.0 – 2.1.4

References & Advisories (2)

Bug Bounty Relevance

55 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

2.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.27%
Raw Score 0.002730
Percentile 19.7%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00273
2026-10-28
0.00273

Intelligence Sources

nvd ref →

External Links