{"cve":"CVE-2024-58367","nvd":{"published":"2026-07-18T14:17:09.737","modified":"2026-10-27T18:10:00.130","status":"Analyzed","description":"SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references to leak protected field contents despite lacking SELECT permissions.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","score":7.1},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","score":6.5},"cwes":["CWE-285"],"references":["https://github.com/surrealdb/surrealdb/security/advisories/GHSA-9722-9j67-vjcr","https://www.vulncheck.com/advisories/surrealdb-before-improper-authorization-via-select-permissions"],"products":["surrealdb:surrealdb"],"source":"nvd","synced_at":"2026-10-27T18:39:43.087796372+00:00"},"epss":{"cve":"CVE-2024-58367","score":0.00358,"percentile":0.29339,"date":"2026-10-27"},"kev":null,"osv":[{"id":"GHSA-9722-9j67-vjcr","url":"https://osv.dev/vulnerability/GHSA-9722-9j67-vjcr","summary":"SurrealDB: Improper Authorization in Select Permissions","modified":"2026-09-04T20:00:28.340319267Z","packages":[{"ecosystem":"crates.io","name":"surrealdb","purl":"pkg:cargo/surrealdb","ranges":["<2.0.4"],"fixed":["2.0.4"]},{"ecosystem":"crates.io","name":"surrealdb-core","purl":"pkg:cargo/surrealdb-core","ranges":["<2.0.4"],"fixed":["2.0.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}