CVE-2024-58367: SurrealDB Information Disclosure Flaw

CVE-2024-58367 Overview

CVE-2024-58367 is a broken access control vulnerability in SurrealDB versions before 2.0.4. The database engine fails to properly enforce field-level permissions during SELECT, UPDATE, and DELETE operations. Authorized users can read protected field values through query techniques that bypass permission checks, including SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references. The vulnerability maps to [CWE-285: Improper Authorization] and carries a CVSS 4.0 score of 7.1. Exploitation requires low-privilege authenticated access over the network and does not require user interaction.

Critical Impact
Authenticated users with limited privileges can extract the contents of fields they are not authorized to read, breaking tenant and row-level confidentiality guarantees in multi-user SurrealDB deployments.

Affected Products

SurrealDB versions prior to 2.0.4
Deployments relying on field-level PERMISSIONS clauses for confidentiality
Multi-tenant applications using SurrealDB for row-level access control

Discovery Timeline

2026-07-18 - CVE-2024-58367 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2024-58367

Vulnerability Analysis

SurrealDB supports granular PERMISSIONS clauses on individual fields, allowing schema designers to restrict which users can SELECT, CREATE, UPDATE, or DELETE specific columns. The vulnerability arises because the query executor evaluates several query constructs before applying field-level SELECT permission checks. As a result, an authenticated user without read access to a protected field can still infer or extract its value through side channels in query evaluation.

Affected query patterns include SELECT VALUE <field>, field aliasing such as SELECT protected AS alias, passing the field to functions like SELECT string::len(protected), filtering with WHERE protected = 'value', using RETURN BEFORE on UPDATE or DELETE statements, and referencing the field on the right side of a SET assignment. Each pattern exposes the field contents or leaks information through boolean predicates.

Root Cause

The root cause is inconsistent enforcement of field permissions across the query planner. Permission checks are applied when a field is returned directly in a projection but are skipped when the field is transformed, aliased, or referenced in a clause that indirectly emits its value. The permission model assumes that blocking direct projection is sufficient, ignoring paths where field values propagate into results, error messages, or return values.

Attack Vector

An attacker authenticated as a low-privileged SurrealDB user submits crafted SurrealQL queries against a table containing fields protected by SELECTPERMISSIONS. By wrapping the target field in an alias, function call, or WHERE predicate, the attacker retrieves values that permission rules should have redacted. On UPDATE and DELETE statements, the RETURN BEFORE clause returns pre-modification values, and SET field = protected_field copies protected content into a writable field. See the GitHub Security Advisory GHSA-9722-9j67-vjcr and the VulnCheck Advisory on SurrealDB for full technique details.

Detection Methods for CVE-2024-58367

Indicators of Compromise

Query logs containing SELECT VALUE statements targeting fields marked with restrictive PERMISSIONS clauses.
UPDATE or DELETE statements using RETURN BEFORE against tables with protected fields.
SET clauses that assign a protected field's value to another field within the same record.
Repeated WHERE predicates on a protected field from a low-privileged user, indicating boolean-based value extraction.

Detection Strategies

Audit SurrealDB query logs for use of field aliasing, SELECT VALUE, and function wrapping against fields defined with PERMISSIONS FOR select.
Correlate authenticated session identity with queries touching sensitive fields to identify access outside expected privilege boundaries.
Deploy database activity monitoring rules that flag RETURN BEFORE usage by roles lacking read access on affected columns.

Monitoring Recommendations

Enable verbose query logging on SurrealDB nodes and forward logs to a centralized SIEM for retention and analysis.
Alert on high-volume queries from a single principal that reference the same protected field with varying WHERE predicates.
Track schema definitions for PERMISSIONS clauses and generate baseline inventories of fields expected to be confidential.

How to Mitigate CVE-2024-58367

Immediate Actions Required

Upgrade all SurrealDB instances to version 2.0.4 or later without delay.
Rotate credentials for any low-privilege users whose sessions may have been used to probe protected fields.
Review application code paths that expose SurrealQL execution to end users and restrict query surface where possible.

Patch Information

SurrealDB addressed the improper authorization in version 2.0.4. The fix extends field-level SELECT permission enforcement to SELECT VALUE, aliases, function arguments, WHERE predicates, RETURN BEFORE results, and SET right-hand-side references. Consult the GitHub Security Advisory GHSA-9722-9j67-vjcr for the complete patch notes and upgrade guidance.

Workarounds

Restrict database access to trusted application service accounts and disable direct SurrealQL access for end users until patched.
Move confidential fields to separate tables governed by table-level PERMISSIONS, which are enforced consistently across query types.
Add an application-layer authorization filter that rejects queries containing RETURN BEFORE, SELECT VALUE, or function wrappers around sensitive column names.

bash

# Verify SurrealDB version and upgrade to the fixed release
surreal version
# Upgrade via the official installer
curl -sSf https://install.surrealdb.com | sh -s -- --version v2.0.4