Description
SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
surrealdb surrealdb
Default version status: unaffected
0 to < 2.1.0affected2.1.0unaffected
pkg:cargo/surrealdbsurrealdb surrealdb
Default version status: unaffected
0 to < 2.1.0affected2.1.0unaffected
pkg:cargo/surrealdb-core