The permission check of `SHOW TABLE ... REGIONS` command is missing
- Dominant language
- Go
- Stars
- 40.5k
- Forks
- 6.2k
- PR merge metrics
- PR metrics pending
Description
## Bug Report
The permission check of a series of `SHOW TABLE ... REGIONS` commands is missing. A user without any privileges can also execute these commands on other users' table.
It can be reproduced on docker image `pingcap/tidb:nightly`.
### 1. Minimal reproduce step (Required)
1. Create an empty user with root:
```sql
-- login as user 'root'
-- create an empty user
CREATE USER foo;
SHOW GRANTS FOR foo;
/*
+---------------------------------+
| Grants for foo@% |
+---------------------------------+
| GRANT USAGE ON *.* TO 'foo'@'%' |
+---------------------------------+
*/
```
2. Log in as the user foo and execute:
```sql
-- login as user 'foo'
SHOW TABLE mysql.user REGIONS;
/*
+-----------+-----------+---------+-----------+-----------------+-------+------------+---------------+------------+----------------------+------------------+------------------------+------------------+
| REGION_ID | START_KEY | END_KEY | LEADER_ID | LEADER_STORE_ID | PEERS | SCATTERING | WRITTEN_BYTES | READ_BYTES | APPROXIMATE_SIZE(MB) | APPROXIMATE_KEYS | SCHEDULING_CONSTRAINTS | SCHEDULING_STATE |
+-----------+-----------+---------+-----------+-----------------+-------+------------+---------------+------------+----------------------+------------------+------------------------+------------------+
| 18 | t_4_ | t_6_ | 19 | 1 | 19 | 0 | 0 | 0 | 0 | 0 | | |
+-----------+-----------+---------+-----------+-----------------+-------+------------+---------------+------------+----------------------+------------------+------------------------+------------------+
1 row in set (0.00 sec)
*/
```
### 2. What did you expect to see? (Required)
Since the user 'foo' does not have any privilege, he should not be able to execute the `SHOW TABLE ... REGIONS` command on unauthorized tables.
### 3. What did you see instead (Required)
The command succeed unexpectedly.
### 4. What is your TiDB version? (Required)
```
+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| tidb_version() |
+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Release Version: v8.5.2-20250707-57b0825
Edition: Community
Git Commit Hash: 57b0825102d3dce7679856df8f39e1c8641285d7
Git Branch: heads/refs/tags/v8.5.2-20250707-57b0825
UTC Build Time: 2025-07-07 09:12:09
GoVersion: go1.23.6
Race Enabled: false
Check Table Before Drop: false
Store: unistore |
+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
```
Contributor guide
Assessment
This issue has not been assessed yet.