CVE-2026-107823

{
  "etk_id": "ETK-2026-1127",
  "cve_id": "CVE-2026-107823",
  "display_id": "CVE-2026-107823",
  "ghsa_id": "GHSA-g2q2-3936-cp37",
  "euvd_id": "EUVD-2026-95923",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Privilege escalation in MariaDB view metadata parsing",
  "summary": "MariaDB Server releases before the listed fixed versions mishandle newline characters in usernames when processing view metadata. An authenticated account with CREATE USER and CREATE VIEW WITH GRANT OPTION permissions may be able to cause unintended privilege elevation.",
  "mitigation": "Upgrade MariaDB Server to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2, or a later release in the applicable branch. Until upgraded, restrict CREATE USER and CREATE VIEW WITH GRANT OPTION to trusted administrators.",
  "vendor": "MariaDB",
  "product": "Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "10.6.1-10.6.27",
        "10.11.1-10.11.18",
        "11.4.1-11.4.12",
        "11.8.1-11.8.8",
        "12.3.1-12.3.2",
        "13.0.1"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "10.6.28",
        "10.11.19",
        "11.4.13",
        "11.8.9",
        "12.3.3",
        "13.0.2"
      ],
      "package_name": null,
      "purl": null
    }
  ],
  "cwes": [
    116
  ],
  "cvss_score": 7.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0071,
  "epss_percentile": 0.5277,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 17.915605516666666,
  "t0_at": "2026-10-09T17:30:36.062000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-09T17:30:36.062000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-09T17:30:36.062000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107823"
    }
  }
}