{"id":"EUVD-2024-55675","enisaUuid":"059f6b3b-f05f-34d6-b319-3649355e8876","description":"SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server.","datePublished":"Jul 18, 2026, 1:10:02 PM","dateUpdated":"Jul 28, 2026, 1:47:47 AM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jc55-246c-r88f\nhttps://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-role\n","aliases":"CVE-2024-58358\nGHSA-9qrf-6whp-92w3\n","assigner":"VulnCheck","epss":0.47,"enisaIdProduct":[{"id":"d534ce95-ffd5-3a2c-9de8-9ce3f6e1bd92","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.1.0"}],"enisaIdVendor":[{"id":"97ed5883-0905-3d1f-a4b2-fe6aa6beae18","vendor":{"name":"surrealdb"}}],"enisaIdVulnerability":[{"id":"6c004e30-c7b5-37dd-8cbf-186a762c5389","vulnerability":{"id":"CVE-2024-58358","description":"SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server.","datePublished":"Jul 18, 2026, 1:10:02 PM","dateUpdated":"Jul 28, 2026, 1:47:47 AM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jc55-246c-r88f\nhttps://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-role\n","enisa_id":"EUVD-2024-55675\n","assigner":"VulnCheck","epss":0.47,"dataProcessed":"Oct 27, 2026, 7:19:40 AM","vulnerabilityProduct":[{"id":"63809455-6765-384d-b3df-3ddd7c01e274","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.1.0"}],"vulnerabilityVendor":[{"id":"b6285117-3921-367e-ab19-f66846220d62","vendor":{"name":"surrealdb"}}]}},{"id":"e5249852-47fd-3dec-aa31-90665fe16ee1","vulnerability":{"id":"GHSA-9qrf-6whp-92w3","description":"Duplicate Advisory: SurrealDB has an Uncaught Exception Handling Nonexistent Role","datePublished":"Jul 18, 2026, 3:31:48 PM","dateUpdated":"Sep 4, 2026, 7:18:07 PM","baseScore":0.0,"references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jc55-246c-r88f\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-58358\nhttps://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-role\n","enisa_id":"EUVD-2024-55675\n","aliases":"GHSA-9qrf-6whp-92w3\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}