CVE-2023-54366
highSurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explici…
Vendor / product: Surrealdb — surrealdb
SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations on unprotected tables within their authorization scope.
CVSS
8.8
8.8 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Severity source: NVD CVSS v3.1 (disclosure@vulncheck.com)
Timeline (UTC)
Published: 2026-07-18 14:17
Modified: 2026-10-28 19:10
NVD status: Analyzed
Last synced 1 day ago
Verified against the source API 2026-10-28 19:26 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
surrealdb / surrealdb <1.0.1
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x5fr-7hhj-34j3
References
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x5fr-7hhj-34j3 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/surrealdb-before-insecure-default-table-permissions disclosure@vulncheck.com
Data sources
NVD CVE API 2.0 — fetched 2026-10-28 19:26 UTC · record ↗