CVE-2026-102523

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-102523
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102523.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-102523
Aliases
  • GHSA-h4vr-wpff-jfx4
Downstream
Related
Published
2026-11-05T15:31:27Z
Modified
2026-11-06T10:46:35Z
Severity
  • 8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION
Details

MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102523.json"
}
References

Affected packages

Git / github.com/mariadb/server

Affected ranges

Type
GIT
Repo
https://github.com/mariadb/server
Events
Introduced
2437674291f31c91869a74eb6ebd9f03dc52bd43
Fixed
93e051860a9c7e87ee8cee6ed38b640d491f7170
Introduced
fa69b085b10f19a3a8b6e7adab27c104924333ae
Fixed
170b1d70737be6f134448f51713cdc1ae215b420
Introduced
1c4aed7c680c0402d6e97e097f03815c0e9bf4c5
Fixed
bf9193a939f515e95dd8def1a5468088c91cede6
Introduced
21a0714a118614982d20bfa504763d7247800091
Fixed
83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e
Introduced
7f923870722c5d382e16d56af526d1ee4e03f987
Fixed
620a4b5624222048fece7fe1789978ae0675cae2
Fixed
98437c30ae52ed709f266e5f8095d779261a5879
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "10.11.1"
                },
                {
                    "fixed": "10.11.19"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "11.4.1"
                },
                {
                    "fixed": "11.4.13"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "11.8.1"
                },
                {
                    "fixed": "11.8.9"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "12.3.1"
                },
                {
                    "fixed": "12.3.3"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "introduced": "13.0.1"
                },
                {
                    "fixed": "13.0.2"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "98437c30ae52ed709f266e5f8095d779261a5879"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "original_tag": "mariadb-10.11.19",
            "range": [
                {
                    "fixed": "93e051860a9c7e87ee8cee6ed38b640d491f7170"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "mariadb-11.4.13",
            "range": [
                {
                    "fixed": "170b1d70737be6f134448f51713cdc1ae215b420"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "mariadb-11.8.9",
            "range": [
                {
                    "fixed": "bf9193a939f515e95dd8def1a5468088c91cede6"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "mariadb-12.3.3",
            "range": [
                {
                    "fixed": "83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "original_tag": "mariadb-13.0.2",
            "range": [
                {
                    "fixed": "620a4b5624222048fece7fe1789978ae0675cae2"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

mariadb-11.*
mariadb-11.4.1
mariadb-11.4.10
mariadb-11.4.11
mariadb-11.4.11b
mariadb-11.4.2
mariadb-11.4.3
mariadb-11.4.4
mariadb-11.4.5
mariadb-11.4.6
mariadb-11.4.7
mariadb-11.4.8
mariadb-11.4.9
mariadb-11.8.1
mariadb-11.8.2
mariadb-11.8.3
mariadb-11.8.4
mariadb-11.8.6
mariadb-11.8.7
mariadb-11.8.7b
mariadb-12.*
mariadb-12.3.1
mariadb-13.*
mariadb-13.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-102523.json"