https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 09:21:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-341653 EUVD-2026-341653 https://cve.radiocsirt.org/vuln/euvd-2026-341653 https://cve.radiocsirt.org/vuln/fkie_cve-2024-58356 <p>SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table&#39;s permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.</p> <p>SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table&#39;s permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-58356 https://cve.radiocsirt.org/vuln/ghsa-27vq-hv74-7cqp <p><strong>Affected:</strong> crates.io: surrealdb, crates.io: surrealdb-core</p> <p>The `OVERWRITE` clause of the `DEFINE TABLE` statement would fail to overwrite data for tables that were defined with `TYPE RELATION`. Since table definitions include the `PERMISSIONS` clause, this failure would result in permissions not being overwritten as a result, which may potentially lead users to believe they have changed the table permissions when they have not.</p> <p>### Impact</p> <p>If a user attempted to update table permissions of a table defined with `TYPE RELATION` using `DEFINE TABLE ... OVERWRITE`, permissions for the table would not be changed. This may allow a client that is authorized to run queries in a SurrealDB server to access certain data in that specific table that they were not intended to be able to access after the specified change in permissions.</p> <p>### Patches</p> <p>The `DEFINE TABLE` statement has been updated to appropriately overwrite data for tables defined with `TYPE RELATION`.</p> <p>- Version 2.1.4 and later are not affected by this issue.</p> <p>### Workarounds</p> <p>Users of tables with `TYPE RELATION` that may have been modified using the `OVERWRITE` clause in order to update permissions are advised to verify that the intended permissions are in place using the `INFO FOR DB` statement. Affected users who are unable to update and require updating permissions in a table with `TYPE RELATION` will be required to remove the table and define it from scratch with the intended permissions. Data can be preserved by backing it up to a temporary table.</p> <p>### References</p> <p>- [#5260](…</p> <p><strong>Affected:</strong> crates.io: surrealdb, crates.io: surrealdb-core</p> <p>The `OVERWRITE` clause of the `DEFINE TABLE` statement would fail to overwrite data for tables that were defined with `TYPE RELATION`. Since table definitions include the `PERMISSIONS` clause, this failure would result in permissions not being overwritten as a result, which may potentially lead users to believe they have changed the table permissions when they have not.</p> <p>### Impact</p> <p>If a user attempted to update table permissions of a table defined with `TYPE RELATION` using `DEFINE TABLE ... OVERWRITE`, permissions for the table would not be changed. This may allow a client that is authorized to run queries in a SurrealDB server to access certain data in that specific table that they were not intended to be able to access after the specified change in permissions.</p> <p>### Patches</p> <p>The `DEFINE TABLE` statement has been updated to appropriately overwrite data for tables defined with `TYPE RELATION`.</p> <p>- Version 2.1.4 and later are not affected by this issue.</p> <p>### Workarounds</p> <p>Users of tables with `TYPE RELATION` that may have been modified using the `OVERWRITE` clause in order to update permissions are advised to verify that the intended permissions are in place using the `INFO FOR DB` statement. Affected users who are unable to update and require updating permissions in a table with `TYPE RELATION` will be required to remove the table and define it from scratch with the intended permissions. Data can be preserved by backing it up to a temporary table.</p> <p>### References</p> <p>- [#5260](…</p> https://cve.radiocsirt.org/vuln/ghsa-27vq-hv74-7cqp