https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-12T09:56:44.167545+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2024-58363 fkie_cve-2024-58363 2026-11-12T09:56:44.168943+00:00

SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.

 https://db.gcve.eu/vuln/ghsa-hgp5-pm7v-q8vg Withdrawn: GHSA-hgp5-pm7v-q8vg — Duplicate Advisory: SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User 2026-11-12T09:56:44.169034+00:00

Withdrawn by the publisher.

Affected: crates.io: surrealdb

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-gh9f-6xm2-c4j2. This link is maintained to preserve external references.

## Original Description SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.