From 8bb4e20ae72ae5245f54db307c1f2037c1185d07 Mon Sep 17 00:00:00 2001
From: Vladislav Vaintroub <vvaintroub@gmail.com>
Date: Mon, 16 Mar 2026 16:31:31 +0100
Subject: [PATCH] MDEV-37256 Add permission check for LOAD INDEX INTO CACHE and
 CACHE INDEX

Previously, no access check was done for these commands. Now, we require
any table-level permission, which consistent with other admin commands
like CHECKSUM.
---
 mysql-test/main/grant5.result | 22 ++++++++++++++++++++++
 mysql-test/main/grant5.test   | 26 ++++++++++++++++++++++++++
 sql/sql_admin.cc              | 19 +++++++++++++++++++
 3 files changed, 67 insertions(+)

diff --git a/mysql-test/main/grant5.result b/mysql-test/main/grant5.result
index d960ed97d49..4b19dd6c4b9 100644
--- a/mysql-test/main/grant5.result
+++ b/mysql-test/main/grant5.result
@@ -472,3 +472,25 @@ DROP USER foo@localhost;
 CREATE USER foo@localhost IDENTIFIED VIA not_installed_plugin;
 ERROR HY000: Plugin 'not_installed_plugin' is not loaded
 # End of 10.5 tests
+#
+# MDEV-37256: The permission check of LOAD INDEX INTO CACHE and CACHE INDEX is broken
+#
+create table t1 (c int primary key);
+insert t1 values (1),(2);
+create user foo@localhost;
+connect foo,localhost,foo;
+use test;
+ERROR 42000: Access denied for user 'foo'@'localhost' to database 'test'
+cache index test.t1 in default;
+ERROR 42000: CACHE INDEX command denied to user 'foo'@'localhost' for table `test`.`t1`
+load index into cache test.t1 key (primary);
+ERROR 42000: LOAD INDEX INTO CACHE command denied to user 'foo'@'localhost' for table `test`.`t1`
+cache index test.t2 in default;
+ERROR 42000: CACHE INDEX command denied to user 'foo'@'localhost' for table `test`.`t2`
+load index into cache test.t2 key (i2);
+ERROR 42000: LOAD INDEX INTO CACHE command denied to user 'foo'@'localhost' for table `test`.`t2`
+disconnect foo;
+connection default;
+drop table t1;
+drop user foo@localhost;
+# End of 10.11 tests
diff --git a/mysql-test/main/grant5.test b/mysql-test/main/grant5.test
index b58173feea3..9a983d645a6 100644
--- a/mysql-test/main/grant5.test
+++ b/mysql-test/main/grant5.test
@@ -436,3 +436,29 @@ DROP USER foo@localhost;
 CREATE USER foo@localhost IDENTIFIED VIA not_installed_plugin;
 
 --echo # End of 10.5 tests
+
+--echo #
+--echo # MDEV-37256: The permission check of LOAD INDEX INTO CACHE and CACHE INDEX is broken
+--echo #
+create table t1 (c int primary key);
+insert t1 values (1),(2);
+create user foo@localhost;
+--connect foo,localhost,foo
+--error ER_DBACCESS_DENIED_ERROR
+use test;
+--error ER_TABLEACCESS_DENIED_ERROR
+cache index test.t1 in default;
+--error ER_TABLEACCESS_DENIED_ERROR
+load index into cache test.t1 key (primary);
+--error ER_TABLEACCESS_DENIED_ERROR
+# Check that the error for non-existing and existing tables are the same
+cache index test.t2 in default;
+--error ER_TABLEACCESS_DENIED_ERROR
+load index into cache test.t2 key (i2);
+--disconnect foo
+--connection default
+# Cleanup
+drop table t1;
+drop user foo@localhost;
+
+--echo # End of 10.11 tests
diff --git a/sql/sql_admin.cc b/sql/sql_admin.cc
index 92fccf77804..d7a616417ff 100644
--- a/sql/sql_admin.cc
+++ b/sql/sql_admin.cc
@@ -1500,6 +1500,15 @@ bool mysql_assign_to_keycache(THD* thd, TABLE_LIST* tables,
   KEY_CACHE *key_cache;
   DBUG_ENTER("mysql_assign_to_keycache");
 
+  if (check_some_access(thd, TABLE_ACLS, tables))
+  {
+    my_error(ER_TABLEACCESS_DENIED_ERROR, MYF(0), "CACHE INDEX",
+             thd->security_ctx->priv_user,
+             thd->security_ctx->host_or_ip,
+             tables->db.str, tables->table_name.str);
+    DBUG_RETURN(TRUE);
+  }
+
   THD_STAGE_INFO(thd, stage_finding_key_cache);
   check_opt.init();
   mysql_mutex_lock(&LOCK_global_system_variables);
@@ -1539,6 +1548,16 @@ bool mysql_assign_to_keycache(THD* thd, TABLE_LIST* tables,
 bool mysql_preload_keys(THD* thd, TABLE_LIST* tables)
 {
   DBUG_ENTER("mysql_preload_keys");
+
+  if (check_some_access(thd, TABLE_ACLS, tables))
+  {
+    my_error(ER_TABLEACCESS_DENIED_ERROR, MYF(0), "LOAD INDEX INTO CACHE",
+             thd->security_ctx->priv_user,
+             thd->security_ctx->host_or_ip,
+             tables->db.str, tables->table_name.str);
+    DBUG_RETURN(TRUE);
+  }
+
   /*
     We cannot allow concurrent inserts. The storage engine reads
     directly from the index file, bypassing the cache. It could read