🎯 New Report #3908943: DROP PACKAGE leaves PACKAGE BODY grant in mysql.procs priv causing privilege escalation
🔺Severity: High
👽 Reporter: heyoimjeb
⭐️ Reputation: 109
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-08-01
⏰ Disclosed: 2026-10-07 19:57:10
📝 Summary: A privilege escalation vulnerability was discovered in package management functionality. When a package was dropped, the associated grant in the privilege table for the package body was not removed, while the package object itself was deleted from the system catalog. If a new package with the same name was subsequently created, the orphaned grant allowed previous users to execute the new package without explicit authorization, running with the new definer's privileges. The vulnerability also propagated through role-based access control to all role members. The issue was specific to package drops, as other similar drop operations correctly cleaned up their respective privilege rows.
📂 Report JSON File: 3908943
@hackeronereports