Execute a mysql stored procedure from the definer account, without execute privileges

Question

I created a stored procedure in my mariaDB database. The definer is a restricted user which has no EXECUTE privilege (at db, table, and procedure levels).

But I can successfully execute this procedure from this account.

Is this a normal behavior, that the definer may execute the procedure even if it has no EXECUTE privilege?

Answer 1

This is normal behavior. From the manual:

The EXECUTE privilege is required to execute stored routines. However, this privilege is granted automatically to the creator of a routine if necessary (and dropped from the creator when the routine is dropped). Also, the default SQL SECURITY characteristic for a routine is DEFINER, which enables users who have access to the database with which the routine is associated to execute the routine.