CVE-2006-4031 in MySQL
Summary
by MITRE
MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to access a table through a previously created MERGE table, even after the user s privileges are revoked for the original table, which might violate intended security policy.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/14/2025
This vulnerability in MySQL versions 4.1 before 4.1.21 and 5.0 before 5.0.24 represents a critical access control flaw that undermines the database's privilege management system. The issue stems from how MySQL handles MERGE tables, which are virtual tables that aggregate data from multiple underlying tables. When a local user creates a MERGE table that references an original table, the system fails to properly enforce privilege revocation, allowing the user to maintain access to the underlying data even after their direct privileges to the original table have been removed. This represents a clear violation of the principle of least privilege and demonstrates a fundamental flaw in MySQL's access control implementation.
The technical root cause of this vulnerability lies in the improper handling of privilege checks during MERGE table operations. When a user with access to a table creates a MERGE table that references it, MySQL stores references to the original table metadata but does not consistently revalidate access permissions when the MERGE table is subsequently accessed. This flaw specifically affects local users who have the ability to create MERGE tables, as they can exploit this behavior to maintain unauthorized access to data. The vulnerability is particularly dangerous because it operates at the database engine level and bypasses normal privilege enforcement mechanisms that should prevent such access violations.
The operational impact of this vulnerability extends beyond simple data exposure, as it enables potential privilege escalation and data leakage scenarios that can compromise entire database systems. Attackers can exploit this weakness to access sensitive information even after administrative revocation of direct table access, potentially leading to unauthorized data exfiltration, modification, or deletion. This vulnerability directly violates security policies and can result in compliance violations, particularly in regulated environments where access controls are strictly enforced. The impact is especially severe in multi-user environments where different users require different levels of access to the same database resources.
Organizations should immediately apply the official patches released by MySQL to address this vulnerability, which include fixes to the privilege checking mechanisms for MERGE tables. System administrators should conduct comprehensive audits of existing MERGE tables to identify potential exposure risks and consider implementing additional monitoring controls to detect unauthorized table creation. The vulnerability aligns with CWE-284 (Improper Access Control) and can be categorized under ATT&CK technique T1078 (Valid Accounts) as it exploits legitimate user privileges to maintain access beyond intended permissions. Additionally, this issue demonstrates the importance of implementing principle of least privilege and proper access control validation in database systems, as it represents a failure in the database engine's authorization subsystem to properly enforce security policies.