CyberRota Analysis
AI-GeneratedSurrealDB versions prior to 1.5.4 are vulnerable due to inadequate authentication validation when users switch databases, potentially allowing an attacker with an authenticated session to impersonate another user if their identifiers match. This could lead to unauthorized access and actions within different databases, compromising data integrity and security. Organizations using SurrealDB should prioritize patching to mitigate this risk, especially those managing sensitive or multi-tenant environments.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter.
Related CVEs
Other vulnerabilities affecting the same vendor(s)