{"id":"EUVD-2024-55683","revision":null,"records":[{"revision":"05044e1284224e9f9c4a48187fcdbe8a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2024-58367","aliases":[],"title":"SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions","description":"SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references to leak protected field contents despite lacking SELECT permissions.","state":0,"publishedAt":"2026-07-18T13:10:07.604+00:00","modifiedAt":"2026-07-28T01:47:53.305+00:00","affected":[{"ecosystem":"Vendor product","name":"surrealdb","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"surrealdb\",\n                    \"product\": \"surrealdb\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:cargo/surrealdb\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"2.0.4\"\n                        },\n                        {\n                            \"version\": \"2.0.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"surrealdb","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"surrealdb\",\n                    \"product\": \"surrealdb\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:cargo/surrealdb-core\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"2.0.4\"\n                        },\n                        {\n                            \"version\": \"2.0.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":7.1,"severity":"HIGH"}],"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-9722-9j67-vjcr","https://www.vulncheck.com/advisories/surrealdb-before-improper-authorization-via-select-permissions"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2024-58367","license":"CVE Program Terms of Use","key":"cve-program:CVE-2024-58367","identifiers":["CVE-2024-58367"]},"retained":false,"historicalAffected":[]},{"revision":"f8f5df21576f40ee8c77755ede5ad2bb","observedAt":"2026-10-29T21:24:43.953+00:00","statement":{"source":"euvd","id":"EUVD-2024-55683","aliases":["CVE-2024-58367","GHSA-j9rh-f527-3x87"],"title":"SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit S…","description":"SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references to leak protected field contents despite lacking SELECT permissions.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":7.1,"severity":null}],"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-9722-9j67-vjcr","https://www.vulncheck.com/advisories/surrealdb-before-improper-authorization-via-select-permissions"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-55683","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 18, 2026, 1:10:07 PM","dateUpdated":"Jul 28, 2026, 1:47:53 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2024-55683","identifiers":["EUVD-2024-55683","CVE-2024-58367","GHSA-j9rh-f527-3x87"]},"retained":false,"historicalAffected":[]},{"revision":"c35097766943417a89f3d17d78f4d8a4","observedAt":"2026-10-29T03:27:18.135+00:00","statement":{"source":"nvd","id":"CVE-2024-58367","aliases":[],"title":"SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit S…","description":"SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references to leak protected field contents despite lacking SELECT permissions.","state":0,"publishedAt":"2026-07-18T14:17:09.737+00:00","modifiedAt":"2026-10-27T18:10:00.13+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.1,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-9722-9j67-vjcr","https://www.vulncheck.com/advisories/surrealdb-before-improper-authorization-via-select-permissions"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-58367","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-285"],"productCriteria":["cpe:2.3:a:surrealdb:surrealdb:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-07-18T14:17:09.737","lastModified":"2026-10-27T18:10:00.130"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2024-58367","identifiers":["CVE-2024-58367"]},"retained":false,"historicalAffected":[]},{"revision":"fd46ac73d8e44f6397e485e7fce10d79","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-9722-9j67-vjcr","aliases":["CVE-2024-58367"],"title":"SurrealDB: Improper Authorization in Select Permissions","description":"Due to the order in which permissions were processed, some statements, filters and computations could lead to leaking field values or record contents to users without the required permissions. This behavior could be triggered in different scenarios:\n\n- When performing a `SELECT` operation on a table, the values that would be returned were iterated over, field permissions would be validated and any unauthorized value would be removed from the result returned. However, performing a `SELECT VALUE` operation (e.g. `SELECT VALUE private FROM data`) would result in a non-iterable value, which would not be removed from the returned result.\n\n- When aliasing a field (e.g. `SELECT private AS public FROM data`) for which the user did not have `SELECT` permissions within a `SELECT` query, permissions would be checked against the field of the resulting document containing the aliased field instead of the original document containing the original field. As a consequence, the original field value would be returned as the returned field would not match the original field where permissions had been defined.\n\n- When calling a function in the context of a `SELECT` query and passing a field with permissions as an argument to the function (e.g. `SELECT string::lowercase(private) FROM data`), the function would receive the field value before it had been removed from the document due to `SELECT` permissions. As a result, the function would have access to the value of the field regardless of field permissions. This case includes functions called from within events and other clauses that support function calling.\n\n- When executing a query containing a `WHERE` clause filtering records by a field that the querying user does not have access to `SELECT` (e.g. `SELECT public FROM data WHERE private ~ \"secret\"`), the response of that query would still take the value of the field into account. Even though the value of the protected field would not be returned, this behavior could be used as a side channel by the querying user to infer information about the value of the field.\n\n- When performing `UPDATE` or `DELETE` operations over a table with a user that had those permissions but no `SELECT` permission, the `RETURN BEFORE` clause could be used (e.g. `DELETE data RETURN BEFORE`) to read the contents of the records prior to the authorized update or the deletion despite the querying user not being authorized to perform `SELECT` operations.\n\n- When performing `UPDATE` operations on a table for which the user had `SELECT` and `UPDATE` permissions, the `SET` clause could reference fields that the user had `UPDATE` but no `SELECT` permission for (e.g. `UPDATE data SET public = private`) in order to update the value of a field that the user had permission to `SELECT` to the value of another field for which the user did not.\n\n### Impact\n\nClients that were authorized by table permissions to execute `SELECT` statements for a table but were not authorized by field permissions to run `SELECT` queries for a specific field could still have been able to gain knowledge of the value of that field. Additionally, clients that were authorized to execute `UPDATE` or `DELETE` statements for a table but not authorized to execute `SELECT` statements for the same table may have been able to gain knowledge of the contents of records in that table. This could only be exploited by users who were already authorized to execute queries on the database with the affected table or field.\n\nDue to its relationship with table and field permissions, which apply mainly to record users rather than system users, this issue mostly affects users relying on SurrealDB as a backend-as-a-service rather than SurrealDB as a traditional database backend.\n\n### Patches\n\nThe behavior when evaluating table or field permissions and filtering records or fields as a result of those evaluations has been improved to consider permissions before any changes to the document have been made and, when relevant, permissions after changes to the document have taken place. When a user is unauthorized to view record contents and field values by permissions, the returned documents will behave as if the record or field did not exist in order to prevent leaking any information.\n\n- Version 2.0.4 and later are not affected by this issue.\n\n### Workarounds\n\nUsers affected by this issue and unable to update should not rely on the authorization provided by field permissions when it comes to the `SELECT` permission. Instead, read access to fields in affected versions should be restricted at the table level. When allowing the `UPDATE` or `DELETE` operations for records via table permissions, users should not rely of the authorization provided by the `SELECT` permission. Instead, users should not allow clients to `UPDATE` or `DELETE` records that they should not be able to view.","state":0,"publishedAt":"2024-10-08T22:21:09+00:00","modifiedAt":"2026-09-04T20:00:28.3403193+00:00","affected":[{"ecosystem":"crates.io","name":"surrealdb","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"surrealdb-core","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-9722-9j67-vjcr","https://nvd.nist.gov/vuln/detail/CVE-2024-58367","https://github.com/surrealdb/surrealdb/issues/2161","https://github.com/surrealdb/surrealdb/issues/3924","https://github.com/surrealdb/surrealdb/pull/4785","https://github.com/surrealdb/surrealdb/pull/4800","https://github.com/surrealdb/surrealdb/pull/4873","https://github.com/surrealdb/surrealdb/commit/439ab99e15314ec5cf87047bf58246db646e3f8c","https://github.com/surrealdb/surrealdb/commit/c382fa158dc84b329328606f663efe574f102a7d","https://github.com/surrealdb/surrealdb/commit/e75e7736b3a028c4b6a4a4bdf00791d76f77e339","https://github.com/surrealdb/surrealdb","https://surrealdb.com/docs/surrealdb/security/summary#permissions","https://surrealdb.com/docs/surrealql/statements/define/field#setting-permissions-on-fields","https://surrealdb.com/docs/surrealql/statements/define/table#defining-permissions","https://www.vulncheck.com/advisories/surrealdb-before-improper-authorization-via-select-permissions"],"sourceUrl":"https://github.com/advisories/GHSA-9722-9j67-vjcr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-9722-9j67-vjcr","identifiers":["GHSA-9722-9j67-vjcr","CVE-2024-58367"]},"retained":false,"historicalAffected":[]},{"revision":"e92d5fb7bcae467bae6049389372cc63","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-j9rh-f527-3x87","aliases":[],"title":"Duplicate Advisory: Improper Authorization in Select Permissions","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00A0GHSA-9722-9j67-vjcr. This link is maintained to preserve external references.\n\n## Original Description\nSurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references to leak protected field contents despite lacking SELECT permissions.","state":2,"publishedAt":"2026-07-18T15:31:49+00:00","modifiedAt":"2026-09-04T19:45:07.0101611+00:00","affected":[{"ecosystem":"crates.io","name":"surrealdb","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-9722-9j67-vjcr","https://nvd.nist.gov/vuln/detail/CVE-2024-58367","https://www.vulncheck.com/advisories/surrealdb-before-improper-authorization-via-select-permissions"],"sourceUrl":"https://github.com/advisories/GHSA-j9rh-f527-3x87","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-j9rh-f527-3x87","identifiers":["GHSA-j9rh-f527-3x87"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-30T23:47:38.6611239+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-10-30T23:47:38.6611239+00:00","lastSuccessAt":"2026-10-30T23:47:38.7981231+00:00","error":null,"lastVerifiedAt":"2026-10-30T23:47:38.7981272+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7e2c4e7288f2c464ad8c61f3bb6017374714faedcc781283ac06a706ee1a820b-2ab14bbac7aed146eb4566d0c0f2f6122020a00e6e03e98c548f6ca78b564d0c","complete":true,"records":417480,"lastAttemptAt":"2026-10-30T23:45:38.1384309+00:00","lastSuccessAt":"2026-10-30T23:45:37.8421483+00:00","error":null,"lastVerifiedAt":"2026-10-30T23:45:38.1384309+00:00","snapshotPublishedAt":"2026-10-30T23:26:20+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-5c4d9b0ebd9c445abca7ac807c045a95","complete":true,"records":13563,"lastAttemptAt":"2026-10-30T23:48:39.3566895+00:00","lastSuccessAt":"2026-10-30T23:48:39.352+00:00","error":null,"lastVerifiedAt":"2026-10-30T23:48:39.352+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13635,"expectedIdentifiers":13635,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-30T23:47:38.6611239+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-30T23:47:38.6611239+00:00","lastSuccessAt":"2026-10-30T23:47:38.7988619+00:00","error":null,"lastVerifiedAt":"2026-10-30T23:47:38.7988621+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3efe320089534490a7efc7cb0dceb029","complete":false,"records":13575,"lastAttemptAt":"2026-10-30T23:48:04.1207299+00:00","lastSuccessAt":"2026-10-30T23:48:04.117+00:00","error":null,"lastVerifiedAt":"2026-10-30T23:48:04.117+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13599,"expectedIdentifiers":13635,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-10-30T23:47:34.469798+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-10-30T23:47:34.469798+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-30T23:45:38.2095987+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-30T23:45:38.2095987+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-10-30T23:47:38.6300093+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-10-30T23:47:38.6300093+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-3bba47d78eb61bae29443e8f4fe215a6614d54f3560d07419145a76e9ac024ad","complete":true,"records":230992,"lastAttemptAt":"2026-10-30T23:47:25.6345449+00:00","lastSuccessAt":"2026-10-30T23:47:24.2343384+00:00","error":null,"lastVerifiedAt":"2026-10-30T23:47:25.6345449+00:00","snapshotPublishedAt":"2026-10-30T23:18:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}