GHSA-9qrf-6whp-92w3

Duplicate Advisory: SurrealDB has an Uncaught Exception Handling Nonexistent Role

Published

2026-07-18

Modified

2026-09-04

Sources

github-advisory

Summary

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jc55-246c-r88f. This link is maintained to preserve external references. ## Original Description SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define users with nonexistent roles. Attackers can trigger an uncaught panic by signing in with a user assigned an invalid role, crashing the server.

Affected packages

Remediation: No patched version is listed by GitHub.

References

• https://github.com/advisories/GHSA-9qrf-6whp-92w3