{"id":"CVE-2026-102523","kind":"vulnerability","aliases":["CVE-2026-102523"],"related":[],"title":"MariaDB: partition conversion lets a database user reach other tables","description":"MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.","summary":"MariaDB's ALTER TABLE ... CONVERT ... PARTITION does not escape user-specified partition names before using them in file paths. An authenticated database user can make the conversion act on table files they are not authorized to read or modify.","severity":"high","cvss":8.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","mariadb","package","self-hosted"],"not_affected_if":["no-untrusted-db-users","unaffected-version"],"how_to_check":null,"fix":"- MariaDB 10.11.x: `10.11.19`\n- MariaDB 11.4.x: `11.4.13`\n- MariaDB 11.8.x: `11.8.9`\n- MariaDB 12.3.x: `12.3.3`\n- MariaDB 13.0.x: `13.0.2`","status":"open","published_at":"2026-11-05T16:17:23+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","triaged_at":"2026-11-05T16:41:25+00:00","updated_at":"2026-11-05T16:41:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-05T16:41:25Z","model":"claude-haiku-5-5","output":{"fix":"- MariaDB 10.11.x: `10.11.19`\n- MariaDB 11.4.x: `11.4.13`\n- MariaDB 11.8.x: `11.8.9`\n- MariaDB 12.3.x: `12.3.3`\n- MariaDB 13.0.x: `13.0.2`","reach":"network","title":"MariaDB: partition conversion lets a database user reach other tables","impact":"medium","summary":"MariaDB's ALTER TABLE ... CONVERT ... PARTITION does not escape user-specified partition names before using them in file paths. An authenticated database user can make the conversion act on table files they are not authorized to read or modify.","audience":"businesses","category":"package","nicknames":[],"who_cares":["mariadb","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Authenticated user reads or modifies tables they lack rights to","analyst_note":"","how_to_check":"- Check the server version with `mariadb --version` or `SELECT VERSION();`\n- Compare it against the affected ranges: 10.11.1 through 10.11.18, 11.4.x before 11.4.13, 11.8.x before 11.8.9, 12.3.x before 12.3.3, 13.0.x before 13.0.2","plain_action":"","needs_analyst":false,"not_affected_if":["unaffected-version","no-untrusted-db-users"],"who_is_affected":"Servers running an affected MariaDB release where users with database accounts can run ALTER TABLE ... CONVERT ... PARTITION. Exposure depends on which accounts exist and what they are allowed to do, so review who holds ALTER privileges. Deployments on unaffected versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000765,"input_tokens":4424,"output_tokens":645,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-102523':13A,16A '-2026':12A,15A '10.11.1':74C '10.11.19':76C,143C '11.4.13':77C,144C '11.8.9':78C,145C '12.3.3':79C,146C '13.0.2':81C,148C 'access':130C 'act':51B 'allow':131C 'alter':25B,82C 'appli':88C 'authent':44B,105C 'author':58B,128C 'communiti':67C 'construct':103C 'convers':3A,50B,119C 'convert':27B,84C 'cve':11A,14A 'databas':6A,17B,45B,106C 'develop':68C 'encod':90C 'escap':31B,115C 'file':41B,54B,123C 'filenam':89C,114C 'filesystem':101C 'fix':140C 'fork':69C 'host':22B 'issu':138C 'let':4A 'make':48B,117C 'mariadb':1A,18B,23B,63C 'modif':136C 'modifi':62B 'mysql':71C 'name':36B,96C,112C 'oper':120C 'packag':19B 'partit':2A,28B,35B,85C,95C,111C 'path':42B,102C 'reach':8A 'read':60B,134C 'requir':113C 'self':21B 'self-host':20B 'server':64C,72C 'specifi':34B,94C 'tabl':10A,26B,53B,83C,122C,133C 'unauthor':132C 'use':38B,98C,109C 'user':7A,33B,46B,93C,107C,125C 'user-specifi':32B,92C 'version':142C","nicknames":[],"mitigations":[],"who_affected":"Servers running an affected MariaDB release where users with database accounts can run ALTER TABLE ... CONVERT ... PARTITION. Exposure depends on which accounts exist and what they are allowed to do, so review who holds ALTER privileges. Deployments on unaffected versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","mariadb","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-09-07T18:34:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102523","severity":null,"published_at":"2026-11-05T16:17:23+00:00","modified_at":"2026-11-05T16:17:23+00:00","first_seen_at":"2026-11-05T16:40:01+00:00","fetched_at":"2026-11-05T16:40:01+00:00","note":null}],"documents":[{"id":77600,"url":"https://github.com/MariaDB/server/commit/98437c30ae52ed709f266e5f8095d779261a5879","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":43605,"url":"https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":43607,"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":43608,"url":"https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":43609,"url":"https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":43610,"url":"https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":77606,"url":"https://github.com/MariaDB/server/security/advisories/GHSA-h4vr-wpff-jfx4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-07T18:34:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}