{"action":"Upgrade surrealdb to 1.0.1 or later.","affected":[{"fixed":"1.0.1","introduced":"0"}],"component":"surrealdb","cve_ids":["CVE-2023-54366"],"ecosystem":"PyPI","epss":0.00462,"exploited":false,"fixed_versions":["1.0.1"],"ghsa_id":"GHSA-x5fr-7hhj-34j3","id":"tcs_01M5KH6YJ5RDBB0NN6JN2XMP79","modified_at":"2026-08-19T13:45:04.388412762Z","published_at":"2026-07-18T14:17:07.603Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3718","https://github.com/surrealdb/surrealdb/security/advisories/GHSA-x5fr-7hhj-34j3","https://www.vulncheck.com/advisories/surrealdb-before-insecure-default-table-permissions"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2026-3718","url":"https://osv.dev/vulnerability/PYSEC-2026-3718"}],"summary":"SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tables without explicit permissions. Attackers with database ac"}