一句话：提出 Beacon，通过验证 SQL 操作与系统目录的一致性来检测 DBMS 中失效的访问控制漏洞。
DBMS 访问控制至关重要，但其实现复杂，易引入失效访问控制（BAC）漏洞，造成提权、未授权访问甚至系统失陷。现有手工测试耗时且不完整，静态分析难以处理多层、动态变化的权限。Beacon 的核心洞察是：系统目录中对象的可见性应与用户访问权限一致——对象若对用户不可见，用户便不应拥有其访问权限。该工具通过验证 SQL 操作与系统目录的一致性来发现越权不一致，从而检测 BAC 漏洞。作者在八个主流 DBMS（如 MySQL、MariaDB）上测试，发现 39 个此前未知漏洞，其中 19 个可提权、20 个可未授权泄露信息；7 个已存在超过 6 年，最长 13 年。所有漏洞均获厂商确认，OceanBase 还提供了赏金。
Access control in DBMSs is critical for ensuring data security and integrity. However, the increasing complexity of its implementation often introduces broken access control (BAC) vulnerabilities. These vulnerabilities can lead to severe consequences, including privilege escalation, unauthorized data access, or even full compromise of the DBMS. Existing manual testing for BAC vulnerabilities is time-consuming and incomplete. Automated methods like static analysis also struggle in DBMSs, as static rules are difficult to apply to multi-level and dynamically changing privileges. In this paper, we propose Beacon , which detects BAC vulnerabilities by validating the consistency between SQL operations and system catalogs. Our key insight is that the visibility of objects in the system catalogs is consistent with the user’s access control: if an object is invisible to a user in the system catalogs, the user should not have any access privileges on that. Any inconsistency suggests that a user is exceeding their privileges, indicating a potential BAC vulnerability.We used Beacon to test eight popular DBMSs (e.g., MySQL and MariaDB), uncovering 39 previously unknown BAC vulnerabilities. Among them, 19 result in privilege escalation, and 20 lead to unauthorized information disclosure. Moreover, 7 of them have existed in DBMSs for more than 6 years, with the longest-persisting one lasting 13 years. DBMS vendors took these issues seriously and have already confirmed all of these vulnerabilities. Many vendors provided positive feedback, recognizing the importance of addressing these vulnerabilities. For instance, OceanBase awarded bounties for reported vulnerabilities, underscoring Beacon ’s role in improving DBMS access control.
@article{paperbot3790,
title = {Beacon: Detecting Broken Access Control Vulnerabilities in DBMSs via System Catalog Consistency Validation},
author = {Zongrui Peng and Jingzhou Fu and Zhiyong Wu and Jie Liang and Xiangdong Huang and Dalong Shi and Yu Jiang},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {OOPSLA1},
year = {2026},
doi = {10.1145/3798232}
}