{"id":"EUVD-2024-55679","enisaUuid":"280a5bb6-24c0-3aa5-8324-4f07b5bcc15e","description":"SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.","datePublished":"Jul 18, 2026, 1:10:04 PM","dateUpdated":"Jul 28, 2026, 1:47:50 AM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2\nhttps://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch\n","aliases":"CVE-2024-58363\nGHSA-hgp5-pm7v-q8vg\n","assigner":"VulnCheck","epss":0.34,"enisaIdProduct":[{"id":"44d64dc2-53fc-3c03-af9c-faf2c8061506","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.0.0-alpha.6"},{"id":"5d3d3644-0f1f-3d55-be26-26fc4de61791","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.5.1"},{"id":"daa4cb56-87a8-339c-a545-212db757c495","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.5.4"}],"enisaIdVendor":[{"id":"fad1f018-7909-36a1-95e5-ffe65300f522","vendor":{"name":"surrealdb"}}],"enisaIdVulnerability":[{"id":"c085a8de-678d-36c4-bff2-431f828cc3c0","vulnerability":{"id":"GHSA-hgp5-pm7v-q8vg","description":"Duplicate Advisory: SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User","datePublished":"Jul 18, 2026, 3:31:48 PM","dateUpdated":"Sep 4, 2026, 6:43:49 PM","baseScore":0.0,"references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-58363\nhttps://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch\n","enisa_id":"EUVD-2024-55679\n","aliases":"GHSA-hgp5-pm7v-q8vg\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d72f2dc6-a2a3-378c-90b7-1f439d024f07","vulnerability":{"id":"CVE-2024-58363","description":"SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.","datePublished":"Jul 18, 2026, 1:10:04 PM","dateUpdated":"Jul 28, 2026, 1:47:50 AM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2\nhttps://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch\n","enisa_id":"EUVD-2024-55679\n","assigner":"VulnCheck","epss":0.34,"dataProcessed":"Oct 27, 2026, 7:19:40 AM","vulnerabilityProduct":[{"id":"0def99ea-cc45-3e7e-8bb1-f8b7af043d21","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.5.1"},{"id":"4871c818-31a8-37f8-b64f-ef79360f447f","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c2.0.0-alpha.6"},{"id":"bac8b6c7-b17f-340b-9c2c-56bde7b1c6f1","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.5.4"}],"vulnerabilityVendor":[{"id":"b1b9fb81-610f-32b0-93a4-be6a4725c63d","vendor":{"name":"surrealdb"}}]}}],"enisaIdAdvisory":[]}