CVE-2024-58356
Received Received - Intake

SurrealDB TYPE RELATION Table Overwrite Fails to Apply Permissions

Publication date: 2026-07-18

Last updated on: 2026-07-18

Assigner: VulnCheck

Description
SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-18
Last Modified
2026-07-18
Generated
2026-07-18
AI Q&A
2026-07-18
EPSS Evaluated
N/A
NVD
CVE-2024-58356
EUVD
EUVD-2024-55673

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
surrealdb surrealdb to 2.1.4 (exc)
surrealdb surrealdb-core to 2.1.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-276 During installation, installed file permissions are set to allow anyone to modify those files.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SurrealDB before version 2.1.4 has a flaw where using DEFINE TABLE ... OVERWRITE on TYPE RELATION tables silently fails to update the table definition, particularly the PERMISSIONS clause. This means permission changes intended by administrators are not applied, leaving data accessible to unauthorized clients who believe permissions were updated.

Detection Guidance

To detect this vulnerability, check the SurrealDB version installed on your system. Run the command 'surrealdb version' or inspect the package version in your environment. If the version is below 2.1.4, the system is vulnerable. Additionally, verify table permissions using the 'INFO FOR DB' statement to confirm if permissions were not updated after using DEFINE TABLE ... OVERWRITE.

Impact Analysis

If you use SurrealDB versions before 2.1.4, an attacker with authorized access could retain permissions to data they should no longer be able to view. This could lead to unauthorized data access or modification, even after permission changes are attempted.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR or HIPAA. Organizations relying on SurrealDB may face compliance violations if permissions are not correctly enforced.

Mitigation Strategies

Immediately upgrade SurrealDB to version 2.1.4 or later. After upgrading, verify all table permissions using the 'INFO FOR DB' statement. If permissions were previously updated but not applied, recreate the affected tables with the correct permissions. Backup data to a temporary table before making changes to avoid data loss.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-58356. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart