{"id":"EUVD-2024-55678","enisaUuid":"31f57dab-02d7-3232-b619-97276177ef9a","description":"SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode serialization format and supply it in place of credentials. The subquery is then executed within the database owner\u0027s SIGNIN/SIGNUP query under a system user session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources (though not view the query results directly, and not affect IAM resources, which require the owner role).","datePublished":"Jul 18, 2026, 1:10:04 PM","dateUpdated":"Jul 28, 2026, 1:47:49 AM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-64f8-pjgr-9wmr\nhttps://www.vulncheck.com/advisories/surrealdb-before-query-injection-via-rpc-api\n","aliases":"CVE-2024-58362\nGHSA-xw2c-hrr9-4xwr\n","assigner":"VulnCheck","epss":0.64,"enisaIdProduct":[{"id":"15fb5ba5-a527-357d-a726-bd2138e29e69","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.5.5"},{"id":"5295853c-d258-309e-954b-514f41eba810","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"2.0.0-beta.1 \u003c2.0.0-beta.3"},{"id":"5ae83bcd-0378-3df9-af5e-dba9088f0e14","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.5.2"}],"enisaIdVendor":[{"id":"8116f6e6-bfb5-39c7-ab78-79b8a21ac01d","vendor":{"name":"surrealdb"}}],"enisaIdVulnerability":[{"id":"1724b3e3-94d4-3484-b9fb-018e675f82a2","vulnerability":{"id":"GHSA-xw2c-hrr9-4xwr","description":"Duplicate Advisory: Untrusted Query Object Evaluation in RPC API","datePublished":"Jul 18, 2026, 3:31:48 PM","dateUpdated":"Sep 4, 2026, 6:41:12 PM","baseScore":0.0,"references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-64f8-pjgr-9wmr\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-58362\nhttps://www.vulncheck.com/advisories/surrealdb-before-query-injection-via-rpc-api\n","enisa_id":"EUVD-2024-55678\n","aliases":"CVE-2024-58362\nGHSA-xw2c-hrr9-4xwr\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"56bba2d5-bc78-309f-bc3e-d862df26ab80","vulnerability":{"id":"CVE-2024-58362","description":"SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode serialization format and supply it in place of credentials. The subquery is then executed within the database owner\u0027s SIGNIN/SIGNUP query under a system user session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources (though not view the query results directly, and not affect IAM resources, which require the owner role).","datePublished":"Jul 18, 2026, 1:10:04 PM","dateUpdated":"Jul 28, 2026, 1:47:49 AM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-64f8-pjgr-9wmr\nhttps://www.vulncheck.com/advisories/surrealdb-before-query-injection-via-rpc-api\n","enisa_id":"EUVD-2024-55678\n","assigner":"VulnCheck","epss":0.64,"dataProcessed":"Oct 27, 2026, 7:19:40 AM","vulnerabilityProduct":[{"id":"21a9e828-5628-34c0-a65d-231be7323012","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"2.0.0-beta.1 \u003c2.0.0-beta.3"},{"id":"5e4a9c30-dbce-3032-9346-1c8d4af3374a","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.5.2"},{"id":"8553616b-f835-3894-bc39-181b7ab9d003","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.5.5"}],"vulnerabilityVendor":[{"id":"d4ffb8f0-c7a2-3964-b6d2-8d132c0a7f5f","vendor":{"name":"surrealdb"}}]}}],"enisaIdAdvisory":[]}