CVE-2026-102523
MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-102523- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-05
EUVDEUVD-2026-117548
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
EUVD-2026-117548- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-05
NVD
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-102523- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-07
OSVBELL-CVE-2026-102523
- Record
BELL-CVE-2026-102523- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-07
OSV
MariaDB server: Authorization bypass via ALTER TABLE ... CONVERT ... PARTITION
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
CVE-2026-102523- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-73
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2026-102523
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
DEBIAN-CVE-2026-102523- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-07
OSVUBUNTU-CVE-2026-102523
MariaDB server is a community developed fork of MySQL server. From 10.11.1 until 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ALTER TABLE ... CONVERT ... PARTITION does not apply filename encoding to user-specified partition names before using them in filesystem path construction. An authenticated database user can use a partition name requiring filename escaping to make the conversion operate on table files the user is not authorized to access, allowing unauthorized table reads or modifications. This issue is fixed in versions 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
- Record
UBUNTU-CVE-2026-102523- CVSS 3.1
- 8.0 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-07
OSVopenSUSE-SU-2026:12245-1 No score
libmariadbd-devel-12.3.2-3.1 on GA media
These are all security issues fixed in the libmariadbd-devel-12.3.2-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12245-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mariadbAlpaquita:25 |
11.4.5-r0 up to 11.4.13-r0 | 11.4.13-r0 |
mariadbDebian:12 |
All versions, plus listed versions 1:10.11.11-0+deb12u11:10.11.13-0+deb12u11:10.11.14-0+deb12u11:10.11.14-0+deb12u21:10.11.18-0+deb12u1 Show 45 moreShow less1:10.11.19-0+deb12u11:10.11.3-11:10.11.3-2~exp11:10.11.4-11:10.11.4-1~deb12u11:10.11.5-11:10.11.5-21:10.11.5-31:10.11.6-0+deb12u11:10.11.6-11:10.11.6-21:10.11.6-2.1~exp11:10.11.7-11:10.11.7-21:10.11.7-31:10.11.7-41:10.11.8-11:10.11.9-0+deb12u11:11.4.2-11:11.4.2-21:11.4.2-31:11.4.2-41:11.4.3-11:11.4.4-11:11.4.4-21:11.4.4-31:11.4.5-11:11.4.5-2~exp11:11.8.1-11:11.8.1-21:11.8.1-31:11.8.1-41:11.8.1-51:11.8.2-11:11.8.3-11:11.8.5-11:11.8.5-21:11.8.5-31:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-11:11.8.6-21:11.8.6-3 |
None known |
mariadbDebian:13 |
All versions, plus listed versions 1:11.8.2-11:11.8.3-0+deb13u11:11.8.3-11:11.8.5-11:11.8.5-2 Show 18 moreShow less1:11.8.5-31:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-0+deb13u11:11.8.6-11:11.8.6-21:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-61:11.8.8-0+deb13u11:11.8.8-11:11.8.9+ds-11:11.8.9+ds-21:11.8.9+ds-31:11.8.9+ds-4 |
None known |
mariadbDebian:14 |
before 1:11.8.9+ds-1, plus listed versions 1:11.8.2-11:11.8.3-11:11.8.5-11:11.8.5-21:11.8.5-3 Show 11 moreShow less1:11.8.5-3~exp11:11.8.5-3~exp21:11.8.5-3~exp31:11.8.5-41:11.8.6-11:11.8.6-21:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-61:11.8.8-1 |
1:11.8.9+ds-1 |
mariadb-10.0Ubuntu:16.04:LTS |
All versions, plus listed versions 10.0.20-0ubuntu0.15.04.110.0.22-0ubuntu110.0.23-110.0.23-210.0.24-7 Show 9 moreShow less10.0.25-0ubuntu0.16.04.110.0.27-0ubuntu0.16.04.110.0.28-0ubuntu0.16.04.110.0.29-0ubuntu0.16.04.110.0.31-0ubuntu0.16.04.210.0.33-0ubuntu0.16.04.110.0.34-0ubuntu0.16.04.110.0.36-0ubuntu0.16.04.110.0.38-0ubuntu0.16.04.1 |
None known |
mariadb-10.1Ubuntu:18.04:LTS |
All versions, plus listed versions 10.1.25-11:10.1.29-61:10.1.34-0ubuntu0.18.04.11:10.1.38-0ubuntu0.18.04.11:10.1.38-0ubuntu0.18.04.2 Show 6 moreShow less1:10.1.40-0ubuntu0.18.04.11:10.1.41-0ubuntu0.18.04.11:10.1.43-0ubuntu0.18.04.11:10.1.44-0ubuntu0.18.04.11:10.1.47-0ubuntu0.18.04.11:10.1.48-0ubuntu0.18.04.1 |
None known |
mariadb-10.3Ubuntu:20.04:LTS |
All versions, plus listed versions 1:10.3.17-11:10.3.18-11:10.3.19-11:10.3.21-21:10.3.22-1 Show 10 moreShow less1:10.3.22-1ubuntu11:10.3.25-0ubuntu0.20.04.11:10.3.29-0ubuntu0.20.04.11:10.3.30-0ubuntu0.20.04.11:10.3.31-0ubuntu0.20.04.11:10.3.32-0ubuntu0.20.04.11:10.3.34-0ubuntu0.20.04.11:10.3.37-0ubuntu0.20.04.11:10.3.38-0ubuntu0.20.04.11:10.3.39-0ubuntu0.20.04.2 |
None known |
mariadb-10.6Ubuntu:22.04:LTS |
All versions, plus listed versions 1:10.6.7-2ubuntu11:10.6.7-2ubuntu1.11:10.6.11-0ubuntu0.22.04.11:10.6.12-0ubuntu0.22.04.11:10.6.16-0ubuntu0.22.04.1 Show 4 moreShow less1:10.6.18-0ubuntu0.22.04.11:10.6.21-0ubuntu0.22.04.21:10.6.22-0ubuntu0.22.04.11:10.6.23-0ubuntu0.22.04.1 |
None known |
mariadbUbuntu:24.04:LTS |
All versions, plus listed versions 1:10.11.4-11:10.11.5-31:10.11.6-11:10.11.6-21:10.11.7-2ubuntu1 Show 5 moreShow less1:10.11.7-2ubuntu21:10.11.8-0ubuntu0.24.04.11:10.11.11-0ubuntu0.24.04.21:10.11.13-0ubuntu0.24.04.11:10.11.14-0ubuntu0.24.04.1 |
None known |
mariadbUbuntu:26.10 |
All versions, plus listed versions 1:11.8.6-51:11.8.8-11:11.8.9+ds-4ubuntu2 |
None known |
mariadbUbuntu:26.04:LTS |
All versions, plus listed versions 1:11.8.3-1build11:11.8.5-11:11.8.5-21:11.8.5-31:11.8.5-4 Show 5 moreShow less1:11.8.6-11:11.8.6-31:11.8.6-41:11.8.6-51:11.8.6-5ubuntu0.1 |
None known |
mariadbopenSUSE:Tumbleweed From an advisory covering 22 CVEs |
before 12.3.2-3.1 | 12.3.2-3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| affected, aliases, references | NVD, OSV | |
| affected | EUVD, NVD, OSV | |
| aliases, references | CVE List, NVD, OSV | |
| aliases, products | EUVD | |
| cwes, description, facts, products, references, severity, title | CVE List | |
| affected, aliases, references | OSV | |
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-102523 is a high vulnerability (CVSS 8.0) in Devolutions Server, published October 23, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 47th percentile. Fixed in mariadb 11.4.13-r0.
References
github.com/MariaDB/server/security/advisories/GHSA-h4vr-wpff-jfx4
Show 30 moreShow less
jira.mariadb.org/browse/MDEV-40413
docs.bell-sw.com/security/cves/CVE-2026-102523
nvd.nist.gov/vuln/detail/CVE-2026-102523
security-tracker.debian.org/tracker/CVE-2026-102523
ubuntu.com/security/CVE-2026-102523
cve.org/CVERecord?id=CVE-2026-102523
suse.com/security/cve/CVE-2026-102523
Left out here: 8 versions. The JSON record has them.