diff --git a/source/common/src/tmsg.c b/source/common/src/tmsg.c
index 7d517e3e1ecf0fc5ba5872d6bab98ab27ee1e3c9..fbd417368a9123c4c4ee14db5977ec0668e5c84f 100644
--- a/source/common/src/tmsg.c
+++ b/source/common/src/tmsg.c
@@ -1626,6 +1626,8 @@ void tFreeSGetUserAuthRsp(SGetUserAuthRsp *pRsp) {
   taosHashCleanup(pRsp->createdDbs);
   taosHashCleanup(pRsp->readDbs);
   taosHashCleanup(pRsp->writeDbs);
+  taosHashCleanup(pRsp->writeTbs);
+  taosHashCleanup(pRsp->readTbs);
 }
 
 int32_t tSerializeSCreateDropMQSNodeReq(void *buf, int32_t bufLen, SMCreateQnodeReq *pReq) {
diff --git a/source/libs/catalog/src/ctgCache.c b/source/libs/catalog/src/ctgCache.c
index d847735f4f655fe68c3d28d4fe9974c9eaceaec2..ec5807f310c08f714d806d8b5774333a30d3e2b1 100644
--- a/source/libs/catalog/src/ctgCache.c
+++ b/source/libs/catalog/src/ctgCache.c
@@ -2035,6 +2035,14 @@ int32_t ctgOpUpdateUser(SCtgCacheOperation *operation) {
   pUser->userAuth.writeDbs = msg->userAuth.writeDbs;
   msg->userAuth.writeDbs = NULL;
 
+  taosHashCleanup(pUser->userAuth.readTbs);
+  pUser->userAuth.readTbs = msg->userAuth.readTbs;
+  msg->userAuth.readTbs = NULL;
+
+  taosHashCleanup(pUser->userAuth.writeTbs);
+  pUser->userAuth.writeTbs = msg->userAuth.writeTbs;
+  msg->userAuth.writeTbs = NULL;
+
   CTG_UNLOCK(CTG_WRITE, &pUser->lock);
 
 _return:
@@ -2042,6 +2050,8 @@ _return:
   taosHashCleanup(msg->userAuth.createdDbs);
   taosHashCleanup(msg->userAuth.readDbs);
   taosHashCleanup(msg->userAuth.writeDbs);
+  taosHashCleanup(msg->userAuth.readTbs);
+  taosHashCleanup(msg->userAuth.writeTbs);
 
   taosMemoryFreeClear(msg);
 
@@ -2234,6 +2244,8 @@ void ctgFreeCacheOperationData(SCtgCacheOperation *op) {
       taosHashCleanup(msg->userAuth.createdDbs);
       taosHashCleanup(msg->userAuth.readDbs);
       taosHashCleanup(msg->userAuth.writeDbs);
+      taosHashCleanup(msg->userAuth.readTbs);
+      taosHashCleanup(msg->userAuth.writeTbs);
       taosMemoryFreeClear(op->data);
       break;
     }
diff --git a/source/libs/catalog/src/ctgUtil.c b/source/libs/catalog/src/ctgUtil.c
index 4fd5f126f3e599a66ca9785cfec7d5a879718ef5..a5bed110df48144ad3eb4f4e1ff1a80fe8dfe722 100644
--- a/source/libs/catalog/src/ctgUtil.c
+++ b/source/libs/catalog/src/ctgUtil.c
@@ -425,6 +425,8 @@ void ctgFreeMsgCtx(SCtgMsgCtx* pCtx) {
       taosHashCleanup(pOut->createdDbs);
       taosHashCleanup(pOut->readDbs);
       taosHashCleanup(pOut->writeDbs);
+      taosHashCleanup(pOut->readTbs);
+      taosHashCleanup(pOut->writeTbs);
       taosMemoryFreeClear(pCtx->out);
       break;
     }
diff --git a/tests/system-test/0-others/user_control.py b/tests/system-test/0-others/user_control.py
index d27892b588a832ff1edeb581b1975e9771510383..7b5578ba45f66bd3a993f0ce2ee666dcf802d3b3 100644
--- a/tests/system-test/0-others/user_control.py
+++ b/tests/system-test/0-others/user_control.py
@@ -444,7 +444,7 @@ class TDTestCase:
             self.__grant_user_privileges(privilege="", dbname="db", user_name=self.__user_list[0]) ,
             self.__grant_user_privileges(privilege=" ".join(self.__privilege), user_name=self.__user_list[0]) ,
             f"GRANT {self.__privilege[0]} ON * TO {self.__user_list[0]}" ,
-            f"GRANT {self.__privilege[0]} ON {DBNAME}.{NTBNAME} TO {self.__user_list[0]}" ,
+            # f"GRANT {self.__privilege[0]} ON {DBNAME}.{NTBNAME} TO {self.__user_list[0]}" ,
         ]
 
     def __revoke_err(self):
@@ -456,7 +456,7 @@ class TDTestCase:
             self.__revoke_user_privileges(privilege="", dbname="db", user_name=self.__user_list[0]) ,
             self.__revoke_user_privileges(privilege=" ".join(self.__privilege), user_name=self.__user_list[0]) ,
             f"REVOKE {self.__privilege[0]} ON * FROM {self.__user_list[0]}" ,
-            f"REVOKE {self.__privilege[0]} ON {DBNAME}.{NTBNAME} FROM {self.__user_list[0]}" ,
+            # f"REVOKE {self.__privilege[0]} ON {DBNAME}.{NTBNAME} FROM {self.__user_list[0]}" ,
         ]
 
     def test_grant_err(self):