CVE-2026-107822: server >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3…

Affected technology

server · >= 10.6.1, < 10.6.28, >= 10.11.1, < 10.11.19, >= 11.4.1, < 11.4.13, >= 11.8.1, < 11.8.9, >= 12.3.1, < 12.3.3, >= 13.0.1, < 13.0.2
MariaDB

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · High privileges required · User interaction required

What an attacker can do

An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. Vendor/CNA’s CVSS 3.1 assessment (base score 6.4/10) rates confidentiality, integrity and availability impact as high.