The permission check of a series of `ADMIN` commands is missing
- Dominant language
- Go
- Stars
- 40.5k
- Forks
- 6.2k
- PR merge metrics
- PR metrics pending
Description
## Bug Report
The permission check of a series of `ADMIN` commands is missing. A user without any privileges can also execute these commands.
It can be reproduced on docker image `pingcap/tidb:nightly`.
### 1. Minimal reproduce step (Required)
1. Create an empty user with root:
```sql
-- login as user 'root'
CREATE USER foo;
```
2. Log in as the user foo and execute:
ADMIN BINDINGS:
```sql
-- login as user 'foo'
ADMIN FLUSH BINDINGS;
ADMIN RELOAD BINDINGS;
ADMIN CAPTURE BINDINGS;
-- Query OK, 0 rows affected (0.00 sec)
```
ADMIN FLUSH:
```sql
ADMIN FLUSH INSTANCE PLAN_CACHE;
ADMIN FLUSH SESSION PLAN_CACHE;
-- Query OK, 0 rows affected (0.00 sec)
```
ADMIN RELOAD:
```sql
ADMIN RELOAD expr_pushdown_blacklist;
ADMIN RELOAD opt_rule_blacklist;
-- Query OK, 0 rows affected (0.00 sec)
```
### 2. What did you expect to see? (Required)
Usually, the `ADMIN` commands require super privilege, so they should fail. For example:
```sql
ADMIN SHOW BDR ROLE;
-- ERROR 8121 (HY000): privilege check for 'Super' fail
```
### 3. What did you see instead (Required)
These commands succeed.
### 4. What is your TiDB version? (Required)
```
+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| tidb_version() |
+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Release Version: v8.5.2-20250707-57b0825
Edition: Community
Git Commit Hash: 57b0825102d3dce7679856df8f39e1c8641285d7
Git Branch: heads/refs/tags/v8.5.2-20250707-57b0825
UTC Build Time: 2025-07-07 09:12:09
GoVersion: go1.23.6
Race Enabled: false
Check Table Before Drop: false
Store: unistore |
+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
```
Contributor guide
Assessment
This issue has not been assessed yet.