CVE-2026-85985: CWE-862: Missing Authorization in MariaDB server

MariaDB server versions from 10.6.1 up to but excluding 10.6.28, 10.11.1 up to but excluding 10.11.19, 11.4.1 up to but excluding 11.4.13, 11.8.1 up to but excluding 11.8.9, 12.3.1 up to but excluding 12.3.3, and 13.0.1 up to but excluding 13.0.2 contain a missing authorization vulnerability (CWE-862) in the CONNECT engine plugin's file-access user-defined functions (UDFs) json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file(). These UDFs fail to enforce the FILE privilege or the secure_file_priv setting, enabling a low-privileged attacker to invoke these functions with filesystem paths to read or write files beyond their database account permissions, constrained only by operating system permissions. This vulnerability has been addressed in the fixed versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

An attacker with low database privileges can exploit this vulnerability to read or write arbitrary files on the filesystem accessible to the database process, bypassing MariaDB's FILE privilege and secure_file_priv restrictions. This could lead to unauthorized data disclosure or modification within the scope of the database server's OS permissions. There is no indication of remote code execution or denial of service. The CVSS score is 5.4 (medium severity).

This vulnerability is fixed in MariaDB versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. Users should upgrade to these or later versions to remediate the issue. No vendor advisory content contradicts this; therefore, upgrading is the recommended mitigation.