VulnSocial

CVE-2026-102523

LOWCVSS 8.0 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-73

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 5 mentions across 3 observed days
  • Momentum state: stable

What's happening

  • Peaked 1d ago at 3 mentions (2026-11-06); latest day: 1
  • 5 total mentions across 3 days

Deep dive

Activity timeline5 mentions / 3d
01223Mentions · 2026-11-05: 1Mentions · 2026-11-06: 3Mentions · 2026-11-07: 111-0511-0611-07
Referenced assets1 URL
Full discourse5 posts
  • Rıdvan Yağlı@ridvanyagli

    🚨 MariaDB'de CVSS 8.0 Yetkilendirme Atlatma Açığı Keşfedildi! CVE-2026-102523, ALTER TABLE ... CONVERT ... PARTITION işlemi üzerinden dosya yolu manipülasyonuna izin veriyor. Kimliği doğrulanmış bir veritabanı kullanıcısı, normalde erişememesi gereken tablo dosyalarını okuyabilir veya değiştirebilir. 🔴 Etkilenen sürümler: MariaDB 10.11, 11.4, 11.8, 12.3 ve 13.0 serilerindeki belirli sürümler. ✅ Düzeltmeler: 10.11.19, 11.4.13, 11.8.9, 12.3.3 ve 13.0.2. Paylaşımlı hosting ortamlarında veritabanı izolasyonu açısından özellikle dikkat edilmesi gerekiyor. Mutlaka güncelleme yapın.

    0411561.0K
    3.2K followersView on X
  • セキュリティ対策Lab@securityLab_jp

    MariaDBに認証済みユーザーによる権限回避の脆弱性「CVE-2026-102523」　他のテーブルを不正に読み取り・変更するおそれ https://rocket-boys.co.jp/security-measures-lab/mariadb-cve-2026-102523-alter-table-partition-authorization-bypass/ #セキュリティ対策Lab #security #securitynews #セキュリティ #セキュリティニュース

    030731.6K
    8.3K followersView on X
  • connect24h@connect24h

    MariaDBの権限分離は、ログイン後の操作までが守備範囲だ。 CVE-2026-102523で指摘されているのは、認証済みユーザーが特定のALTER TABLEを通じ、許可のないテーブルを読み取り・変更できる可能性。 ただ、認証済みなら誰でも即座に悪用できると決めつけるのも危うい。記載されたCVSSベクトルにはUI:Rがあり、ユーザー操作も成立条件に含まれる。この条件とパーティション変換処理の関係が、掘って読むべき箇所。 DBの権限分離は、付与した権限と実際に通る操作の両方で評価する。 https://rocket-boys.co.jp/security-measures-lab/mariadb-cve-2026-102523-alter-table-partition-authorization-bypass/

    00011817
    14.3K followersView on X
  • Nicolas RN / x9nico@x9nico

    🚨 ALERTE CYBER • Faille critique CVE-2026-102523 dans #MariaDB. Un contournement de restrictions via ALTER TABLE permet de lire ou modifier des tables non autorisées. 🛠️ Action : Mettez à jour vos serveurs (10.11.19, 11.4.13, 11.8.9, 12.3.3+). #Infosec #Database

    0000081
    281 followersView on X
  • RackWorks@RackWorksLLC

    Security update: CVE-2026-102523 (MariaDB partition path flaw) We audited our infrastructure, confirmed patched releases, and applied interim mitigation where distro fixes aren't out yet. Running MariaDB on your VPS? Update to 10.11.19 / 11.4.13 / 11.8.9 or newer.

    0000032
    11 followersView on X

Explore more

Back to dashboard