> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cockroachlabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Technical Advisory 96454

export const InternalLink = ({version, path = "", children, ...props}) => {
  let detectedVersion = version || "stable";
  if (typeof window !== 'undefined' && !version) {
    const match = window.location.pathname.match(/\/docs\/([^/]+)/);
    if (match) {
      detectedVersion = match[1];
    }
  }
  const normalizedPath = path.startsWith("/") ? path.slice(1) : path;
  return <a href={`/docs/${detectedVersion}/${normalizedPath}`} {...props}>
      {children}
    </a>;
};

Publication date: February 6, 2023

## Description

The global [`NOSQLLOGIN` privilege](https://www.cockroachlabs.com/docs/v22.2/security-reference/authorization#supported-privileges) does not restrict SQL access as it should. This privilege is [granted](https://www.cockroachlabs.com/docs/v22.2/security-reference/authorization) using `GRANT SYSTEM NOSQLLOGIN TO <user>` but is not properly inspected by authorization checks. The bug was introduced in <InternalLink version="releases" path="v22.2">v22.2.0-alpha.1</InternalLink>.

## Statement

This is resolved in CockroachDB by fixing the logic that inspects the `NOSQLLOGIN` privilege.

The fix has been applied to maintenance releases of CockroachDB <InternalLink version="releases" path="v22.2">v22.2.4</InternalLink>.

## Mitigation

A workaround is to use the older role option syntax: [`ALTER ROLE <user> WITH NOSQLLOGIN`](https://www.cockroachlabs.com/docs/v22.2/alter-role). Note that unlike the global privilege, the role option does not get inherited by users who are members of the role. Users of CockroachDB <InternalLink version="releases" path="v22.2">v22.2.0</InternalLink> through <InternalLink version="releases" path="v22.2">v22.2.3</InternalLink> are encouraged to upgrade to <InternalLink version="releases" path="v22.2">v22.2.4</InternalLink> or a later version.

## Impact

The `NOSQLLOGIN` global privilege does not correctly restrict SQL access. SQL users who should be blocked from running SQL commands are not blocked.

Questions about any technical alert can be directed to our [support team](https://support.cockroachlabs.com/).