SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaug…
Medium CVSS 4.9
Summary
SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server.
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/surrealdb/surrealdb/security/advisories/GHSA-jc55-246c-r88f
- https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-nonexistent-role
Timeline
- nvd_ingest NVD