Duplicate Advisory: SurrealDB has an Uncaught Exception Handling Nonexistent Role

CVE-2024-58358 describes a denial of service vulnerability in SurrealDB before version 2.1.0. The issue arises from improper handling of role conversion where privileged owner users can create users assigned to roles that do not exist. When an attacker signs in using a user with an invalid role, the server encounters an uncaught panic, leading to a crash. This vulnerability is classified under CWE-248 (Uncaught Exception). The CVSS v3.1 score is 4.9 (medium severity), reflecting network attack vector, low complexity, high privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact.

The vulnerability allows attackers to cause a denial of service by crashing the SurrealDB server when signing in with a user assigned a nonexistent role. There is no impact on confidentiality or integrity, but availability is affected due to server crashes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links are provided and no official fix is mentioned, users should monitor vendor communications for updates. Until a fix is available, avoid assigning nonexistent roles to users and restrict privileged owner user actions to trusted administrators.