pingcap / pingcap/tidb

The permission check of `DELETE FROM ... WHERE ...` is incompatible with MySQL

Open
#60,465 3 comments 2 reactions 1 assignee Claimed by @YangKeao View on GitHub
severity/moderate sig/sql-infra type/bug
Dominant language
Go
Stars
40.5k
Forks
6.2k
PR merge metrics
PR metrics pending

Description

## Bug Report

The permission check of `DELETE FROM ... WHERE ...` is incompatible with MySQL.

### 1. Minimal reproduce step

```sql
-- login with user 'root'
DROP DATABASE IF EXISTS test;
CREATE DATABASE test;
DROP USER foo; CREATE USER foo;
GRANT DELETE, CREATE ON *.* TO foo;

-- login with user 'foo'
USE test;
CREATE TABLE t (a INT);
DELETE FROM t WHERE 2>1;
```

### 2. What did you expect to see?
In MySQL:

```
mysql> DELETE FROM t WHERE 2>1;

Query OK, 0 rows affected (0.00 sec)
```

### 3. What did you see instead?
In TiDB:

```
mysql> DELETE FROM t WHERE 2>1;

ERROR 1142 (42000): SELECT command denied to user 'foo'@'%' for table 't'
```

### 4. What is your TiDB version?

docker image `pingcap/tidb:nightly`:

```
Release Version: v9.0.0-beta.1.pre-533-g671534a
Edition: Community
Git Commit Hash: 671534a755e5ac3fbb5b515cc15f4d54142e6810
Git Branch: HEAD
UTC Build Time: 2025-04-09 14:12:27
GoVersion: go1.23.8
Race Enabled: false
Check Table Before Drop: false
Store: unistore
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.