Functions and Procedures in MariaDB all have DEFINER and SECURITY_TYPE options. If SECURITY_TYPE = DEFINER then the function or procedure is run using the privileges of the DEFINER account. If SECURITY_TYPE = INVOKER, then they will be run using the privileges of the user invoking the function or procedure. To list the values of the DEFINER and SECURITY_TYPE in functions and procedures as the database administrator, run the following SQL: MariaDB> SELECT ROUTINE_NAME, ROUTINE_SCHEMA, ROUTINE_TYPE, DEFINER, SECURITY_TYPE FROM information_schema.routines WHERE ROUTINE_SCHEMA NOT IN ('sys','mysql'); Triggers in MariaDB have a DEFINER option. For Triggers the value of the DEFINER determines the privileges to be used at trigger activation time. To list the values of the DEFINER in Triggers, as the database administrator, run the following SQL: MariaDB> SELECT trigger_schema, trigger_name, action_statement, definer FROM information_schema.triggers; If elevation of MariaDB privileges is utilized but not documented, this is a finding. If elevation of MariaDB privileges is documented, but not implemented as described in the documentation, this is a finding. If the privilege-elevation logic can be invoked in ways other than intended, or in contexts other than intended, or by subjects/principals other than intended, this is a finding.