Executive brief
MariaDB Server is a widely used open-source database system. A security flaw in its permission system allows users who have been granted permission to run a specific database routine via a 'role' to also view the underlying source code of that routine, even if they were specifically denied viewing rights. This could lead to the exposure of sensitive business logic or internal database structures contained within the routine's definition.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in MariaDB Server's privilege system. When a user is granted EXECUTE privileges on a stored routine through a role rather than directly, the server fails to properly enforce the SHOW CREATE ROUTINE restriction. This allows an authenticated user with network access to the database to view the full routine definition (source code) by assuming the relevant role, bypassing intended confidentiality controls. The issue stems from the routine-level privilege check not correctly accounting for role-based inheritance during 'SHOW CREATE' operations. Patches are available in versions 11.4.11, 11.8.7, and 12.3.2.
Affected products
- MariaDB MariaDB Server 11.4.1 to 11.4.10, 11.8.1 to 11.8.6, 12.3.1
Timeline
- 2026-04-08: other: Issue reported internally in MariaDB Jira
- 2026-05-18: advisory: GitHub security advisory published
- 2026-06-12: disclosed: CVE published to NVD