MariaDB Server's ACL cache can generate identical keys for a role and a localhost user when both use an empty IP component. An attacker who can issue CREATE USER statements can create a principal that collides with an existing one, causing the cache to hold privileges for the wrong account. The attacker then gains the privileges assigned to the original account, effectively escalating their own access. The flaw is a collision in cache key handling and performs an unintended privilege escalation, represented by the CWE identifiers in the advisory.

Affected are MariaDB Server installations in the following releases: 10.6.1‑10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. All community‑derived MariaDB Server products in these versions are vulnerable until patched.

The CVSS base score is 6.4, indicating medium severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so the public exploitation probability cannot be determined from available data. The likely attack vector is a local attacker with CREATE USER privileges; thus the risk is highest in environments where user creation is broadly granted. No public exploits have been reported, but the potential to acquire any database privileges makes this a significant concern for administrators who do not tightly control user creation.