This vulnerability in Oracle MySQL Server’s Information Schema component allows an attacker who has low privileges and network access to read a subset of data that the server exposes. The weakness is an access control flaw that bypasses authorization checks, which reduces confidentiality by exposing non‑critical informational data. Successful exploitation requires no local privileges on the server and no user interaction, making the attack straightforward under the conditions enumerated.

Affected Oracle MySQL Server releases are 8.0.0 through 8.0.45, 8.4.0 through 8.4.8, and 9.0.0 through 9.6.0. Any deployment using these versions on a network that can reach the MySQL protocols is at risk.

The bug can be exploited remotely via the common MySQL protocols; the CVSS 3.1 base score of 4.3 reflects a moderate confidentiality impact. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of exploitation depends largely on the exposure of the MySQL server. Because the attack requires only network access and minimal effort, the risk is moderate yet significant for exposed installations.