{"id":"EUVD-2024-55679","enisaUuid":"280a5bb6-24c0-3aa5-8324-4f07b5bcc15e","description":"SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.","datePublished":"Jul 18, 2026, 1:10:04 PM","dateUpdated":"Oct 29, 2026, 8:18:53 PM","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2\nhttps://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch\n","aliases":"CVE-2024-58363\nGHSA-hgp5-pm7v-q8vg\n","assigner":"VulnCheck","epss":0.34,"enisaIdProduct":[{"id":"9f0effa4-0194-3c50-98fe-4539777743f4","product":{"name":"surrealdb-core","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.5.1"},{"id":"ce785b63-522a-38ad-9a11-b248202e2547","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"2.0.0-alpha.1 \u003c2.0.0-alpha.6"},{"id":"daa4cb56-87a8-339c-a545-212db757c495","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.5.4"}],"enisaIdVendor":[{"id":"fad1f018-7909-36a1-95e5-ffe65300f522","vendor":{"name":"surrealdb"}}],"enisaIdVulnerability":[{"id":"c085a8de-678d-36c4-bff2-431f828cc3c0","vulnerability":{"id":"GHSA-hgp5-pm7v-q8vg","description":"Duplicate Advisory: SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User","datePublished":"Jul 18, 2026, 3:31:48 PM","dateUpdated":"Sep 4, 2026, 6:43:49 PM","baseScore":0.0,"references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-58363\nhttps://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch\n","enisa_id":"EUVD-2024-55679\n","aliases":"GHSA-hgp5-pm7v-q8vg\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:47 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"d72f2dc6-a2a3-378c-90b7-1f439d024f07","vulnerability":{"id":"CVE-2024-58363","description":"SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.","datePublished":"Jul 18, 2026, 1:10:04 PM","dateUpdated":"Oct 29, 2026, 8:18:53 PM","status":"PUBLISHED","baseScore":5.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","references":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-gh9f-6xm2-c4j2\nhttps://www.vulncheck.com/advisories/surrealdb-before-authentication-bypass-via-database-switch\n","enisa_id":"EUVD-2024-55679\n","assigner":"VulnCheck","epss":0.34,"dataProcessed":"Oct 29, 2026, 11:00:36 PM","vulnerabilityProduct":[{"id":"0474b717-eb01-36c4-92c2-9ef03c114a5a","product":{"name":"surrealdb-core","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.5.1"},{"id":"bac8b6c7-b17f-340b-9c2c-56bde7b1c6f1","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"0 \u003c1.5.4"},{"id":"bc1bd394-e8a1-37ec-918d-b6eacb13434d","product":{"name":"surrealdb","vendor":{"name":"surrealdb"}},"product_version":"2.0.0-alpha.1 \u003c2.0.0-alpha.6"}],"vulnerabilityVendor":[{"id":"b1b9fb81-610f-32b0-93a4-be6a4725c63d","vendor":{"name":"surrealdb"}}]}}],"enisaIdAdvisory":[]}