CVE-2025-21567

What it actually does

Flaw in MySQL Server privileges component permits low-privileged network attackers to bypass authorization checks and read a subset of accessible data via multiple protocols.

Why it matters to the business

Organizations running affected database versions face risk of unauthorized data exposure, which could lead to compliance issues or leakage of sensitive information; low exploit likelihood but still requires patching across database deployments.

How an attack unfolds

An attacker with valid low-privileged credentials connects over the network and issues specially crafted requests that exploit the privileges weakness to retrieve data they are not authorized to access.

How to fix it

Upgrade affected MySQL Server installations to fixed versions; for listed Ubuntu packages apply wget updates to 1.20.3-1ubuntu2.1 (20.04), 1.21.2-2ubuntu1.1 (22.04), 1.21.4-1ubuntu4.1 (24.04), or 1.21.3-1ubuntu1.1 (23.10) where applicable.

How to confirm the fix worked

Verify MySQL Server version is no longer in the affected range, review privilege grants, and confirm no unauthorized read paths remain via access testing.

Typical attack path

1. Obtain low-privileged network access to MySQL Server
2. Connect using supported protocols
3. Submit crafted queries or commands that trigger the authorization flaw
4. Read unauthorized subset of data

How to detect it

Review database audit logs for unexpected reads by low-privileged accounts and check connection records for unusual protocol usage after the vulnerability publication date.

What your security team should do

• Apply vendor updates immediately to eliminate the authorization bypass
• Audit low-privileged accounts and restrict network access where possible
• Monitor for unusual data access patterns from low-privilege users