CVE-2026-107823: MariaDB privilege escalation via crafted username

MariaDB Server has a privilege-escalation flaw, CVE-2026-107823 (CVSS 7.2): an authenticated user with CREATE USER and CREATE VIEW WITH GRANT OPTION can craft a username carrying extra view metadata that the parser treats as security metadata. Versions 10.6.1–13.0.1 are affected; no public exploit or active attacks are reported.

• Exploitation requires CREATE USER and CREATE VIEW WITH GRANT OPTION
• Affected: 10.6.1–10.6.27, 10.11.1–10.11.18, 11.4.1–11.4.12, 11.8.1–11.8.8, 12.3.1–12.3.2, 13.0.1
• CVSS v3.1 score is 7.2; no public proof of concept
• Mitigation: remove GRANT OPTION from view accounts and split roles