CVE-2023-54366CWE-276

CVE-2023-54366

High · published July 18, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations on unprotected tables within their authorization scope.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.0th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2026-07-18T18:17Z
Affected products (1)
ProductVersionsFixed in
surrealdb/surrealdb< 1.0.11.0.1
References (2)
https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x5fr-7hhj-34j3 · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-insecure-default-table-permissions · [email protected]
EPSS history
Timeline
  • 18 JUL 13:10Z
    SurrealDB before 1.0.1 Insecure Default Table Permissions
    cvelistv5