CVE-2023-54366

highCVSS 8.8covered by 1 sourcefirst seen 2026-07-18

SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database access or unauthenticated users on publicly exposed instances can perform unrestricted operations on unprotected tables within their authorization scope.

⚡ Watch CVE-2023-54366

Get an email if CVE-2023-54366 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.46% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 38% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2023-54366: SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT…nvd · 2026-07-18

External references

NVD record for CVE-2023-54366

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2023-54366 status](https://www.csirts.com/badge/CVE-2023-54366)](https://www.csirts.com/cve/CVE-2023-54366)