CVE-2024-58356 SurrealDB before 2.1.4 Permission Bypass via DEFINE TABLE OVERWRITE

Low 2.3 Published 18 Jul 2026 Updated 28 Jul 2026

Attackers can bypass intended table permission restrictions in SurrealDB due to a failure in the DEFINE TABLE OVERWRITE clause for relation tables.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2024-58356?

CVE-2024-58356 is a low-severity missing authorization vulnerability in Surrealdb Surrealdb, published on 18 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.

Weakness: CWE-276

Which versions are affected by CVE-2024-58356?

4 open source packages ship an affected version, including surrealdb and surrealdb-core. It affects 1 product.

Package	Affected	Fixed in
`surrealdb` crates.io	From `2.0.0`	`2.1.4`
`surrealdb` crates.io	From `2.0.0`	`2.1.4`
`surrealdb-core` crates.io	From `2.0.0`	`2.1.4`
`surrealdb-core` crates.io	From `2.0.0`	`2.1.4`

Products include Surrealdb Surrealdb.

How do I fix CVE-2024-58356?

Upgrade surrealdb to 2.1.4 or later.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-58356 being exploited?

There is no known exploitation of CVE-2024-58356 in the wild and no public exploit code.

All Surrealdb Surrealdb vulnerabilities

Sources

Also known as GHSA-27vq-hv74-7cqp.