Skip to content
fr Sign in
8.0 High

CVE-2026-102523 MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION

Description

MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

CVSS 3.1 detail

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitable remotely over the network, with an ordinary account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Privileges required
Low
Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected products and versions

Product Affected versions Fixed in
server 13.0 13.0.1 → < 13.0.2 13.0.2
server 12.3 12.3.1 → < 12.3.3 12.3.3
server 11.8 11.8.1 → < 11.8.9 11.8.9
server 11.4 11.4.1 → < 11.4.13 11.4.13
server 10.11 10.11.1 → < 10.11.19 10.11.19

References

Timeline

  1. Published
  2. Last modified

Other CVEs of server

The 27 CVEs of server →
CVE-2026-86047 MariaDB server is a community developed fork of MySQL server 7.7 High CVE-2026-85745 MariaDB server is a community developed fork of MySQL server 4.3 Medium CVE-2026-85748 MariaDB server is a community developed fork of MySQL server 9.9 Critical CVE-2026-85746 MariaDB server is a community developed fork of MySQL server 9.9 Critical
Track this CVE