GHSA-M8PP-QC66-6PGP Duplicate Advisory: Full Table Permissions by Default

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x5fr-7hhj-34j3. This link is maintained to preserve external references. Original Description SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and...

CVE-2023-54366

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations o...

CVE-2023-54366

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations o...

CVE-2023-54366

CVE-2023-54366 affects SurrealDB prior to 1.0.1, where default table permissions are set to FULL instead of NONE. This misconfiguration allows attackers with database access or unauthenticated users on publicly exposed instances to perform uncontrolled SELECT, CREATE, UPDATE, and DELETE operation...

CVE-2023-54366 SurrealDB before 1.0.1 Insecure Default Table Permissions

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations o...

CVE-2023-54366 SurrealDB before 1.0.1 Insecure Default Table Permissions

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations o...

PT-2026-80684

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations o...

PT-2026-60936

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 1.0.1 Description Default table permissions are set to FULL instead of NONE, which allows SELECT, CREATE, UPDATE, and DELETE operations on tables that lack explicit permissions. This allows attackers with database...