🎯 New Report #3880451: Privilege escalation via user controlled usernames / roles and views
🔺Severity: null
👽 Reporter: vortfu
⭐️ Reputation: 519
🛠 State: resolved
💼 Team: MariaDB
💵 Bounty: null
🕐 Submitted: 2026-07-22
⏰ Disclosed: 2026-10-07 19:48:29
📝 Summary: A privilege escalation vulnerability was discovered in the handling of user-controlled usernames and roles in view and stored procedure definers. Newline characters embedded in usernames or roles were not properly sanitized when saved as raw option strings, allowing users to inject arbitrary definer configurations. This enabled attackers to execute SQL queries with elevated privileges by creating views or procedures that would be executed under the context of other users or roles. The vulnerability affected both username-based and role-based definer specifications.
📂 Report JSON File: 3880451
@hackeronereports