https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 12 Nov 2026 09:56:45 +0000 https://db.gcve.eu/vuln/fkie_cve-2024-58363 <p>SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.</p> <p>SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.</p> https://db.gcve.eu/vuln/fkie_cve-2024-58363 https://db.gcve.eu/vuln/ghsa-hgp5-pm7v-q8vg <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> crates.io: surrealdb</p> <p>## Duplicate Advisory</p> <p>This advisory has been withdrawn because it is a duplicate of GHSA-gh9f-6xm2-c4j2. This link is maintained to preserve external references.</p> <p>## Original Description SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> crates.io: surrealdb</p> <p>## Duplicate Advisory</p> <p>This advisory has been withdrawn because it is a duplicate of GHSA-gh9f-6xm2-c4j2. This link is maintained to preserve external references.</p> <p>## Original Description SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.</p> https://db.gcve.eu/vuln/ghsa-hgp5-pm7v-q8vg