Duplicate Advisory: SurrealDB vulnerable to Improper Authentication when Changing Databases as Scope User

SurrealDB prior to version 1.5.4 does not properly validate authentication when a scope user changes databases via the USE clause or use method. This improper authentication allows an attacker with an authenticated session to impersonate an unrelated user in another database if a user record with the same identifier exists there. This can lead to unauthorized actions if permissions rely solely on the $auth parameter. The issue is tracked as CVE-2024-58363 with a CVSS 3.1 score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L).

An attacker with an authenticated session can impersonate another user in a different database if that user has the same identifier, potentially gaining unauthorized access or performing unauthorized actions. The impact includes limited confidentiality, integrity, and availability loss as indicated by the CVSS vector.

A fixed version is available starting from SurrealDB 1.5.4. Users should upgrade to version 1.5.4 or later to remediate this vulnerability. Patch status is confirmed by the versioning information indicating affected versions are prior to 1.5.4.