A flaw in MariaDB server’s routine‑level privilege checks allows a user who has been granted EXECUTE access to a stored routine through a role to read the routine definition, even if that user lacks the SHOW CREATE ROUTINE privilege. This bypass is an authorization violation that can leak confidential code and logic within the database. The vulnerability is a CWE‑266 authorization bypass and a CWE‑863 permission validation error.

MariaDB server products are affected, specifically versions from 11.4.1 up to, but not including, 11.4.11, 11.8.1 up to, but not including, 11.8.7, and the 12.3.1 release. All other MariaDB releases are considered unaffected.

The CVSS score of 4.3 classifies this issue as moderate severity, and the EPSS score of < 1% indicates a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires the attacker to have EXECUTE rights on a routine via a role; from there, the attacker can retrieve the routine’s source text. No elevated privileges or network access are needed beyond the granted role, so the attack vector is likely internal to the database session rather than remote.