CVE-2024-58367None▾ SunlitSurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploi…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
SurrealDB versions before 2.0.4 fail to properly enforce field permissions during SELECT, UPDATE, and DELETE operations, allowing authorized users to access unauthorized field values through various query techniques. Attackers can exploit SELECT VALUE operations, field aliasing, function arguments, WHERE clause filtering, RETURN BEFORE clauses, and SET clause references to leak protected field contents despite lacking SELECT permissions.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-95671Medium· 5.3MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add
CVE-2026-79917Medium· 6.5MaxKB is an open-source AI assistant for enterprise
CVE-2026-63330High· 7.7Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux
CVE-2026-94379Medium· 6.9The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths
CVE-2026-94152Medium· 4.3A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025
CVE-2026-93961Medium· 5.3A security flaw has been discovered in Dromara UJCMS up to 12.3.1