Vulnerability · Published Jul 18, 2026 · Assigned by VulnCheck

CVE-2024-58367SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions

High 7.1

In plain English

A high-severity security flaw in surrealdb from surrealdb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.4%top 70.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references to leak protected field contents despite lacking SELECT permissions.

Affected products (as reported)

Vendor	Product	Versions
surrealdb	surrealdb	0 – before 2.0.4
surrealdb	surrealdb	0 – before 2.0.4

Weakness: CWE-285 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

References

GitHub Security Advisory (GHSA-9722-9j67-vjcr) vendor-advisory
VulnCheck Advisory: SurrealDB before 2.0.4 Improper Authorization via SELECT Permissions third-party-advisory