CVE-2024-58358CWE-248

CVE-2024-58358

Medium · published July 18, 2026

CVSS v3.1

4.9

EPSS

Percentile

39.9

In the wild

Unconfirmed

What it is

SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server.

The record

Technical detail

CVSS v3.1: 4.9 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0: Not supplied
EPSS: 0.00472 · 39.9th percentile
Weakness: CWE-248 · Uncaught Exception
Published: 2026-07-18T18:17Z

Affected products (1)

Product	Versions	Fixed in
surrealdb/surrealdb	< 2.1.0	2.1.0

References (2)

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jc55-246c-r88f · [email protected]https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-role · [email protected]

EPSS history

Timeline

18 JUL 13:10Z
SurrealDB before 2.1.0 Denial of Service via Nonexistent Role
cvelistv5