The Oracle WITH GRANT OPTION privilege must be limited when granted to nondatabase administrator (DBA) or nonapplication administrator user accounts.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-270523	SRG-APP-000516-DB-000363	O19C-00-009000	SV-270523r1167746_rule	2025-12-09	1

Description
Specifying WITH GRANT OPTION enables the grantee to grant the object privileges to other users and roles. An account permission to grant privileges within the database is an administrative function. Minimizing the number and privileges of administrative accounts reduces the chances of privileged account exploitation. Application user accounts limit WITH GRANT OPTION privileges since, by definition, they require only privileges to execute procedures or view/edit data.

Description

Specifying WITH GRANT OPTION enables the grantee to grant the object privileges to other users and roles. An account permission to grant privileges within the database is an administrative function. Minimizing the number and privileges of administrative accounts reduces the chances of privileged account exploitation. Application user accounts limit WITH GRANT OPTION privileges since, by definition, they require only privileges to execute procedures or view/edit data.

ℹ️ Check
Execute the query: select grantee\|\|': '\|\|owner\|\|'.'\|\|table_name from dba_tab_privs where grantable = 'YES' and grantee not in (select distinct owner from dba_objects) and grantee not in (select grantee from dba_role_privs where granted_role = 'DBA') and table_name not like 'SYS_PLSQL_%' order by grantee; If any accounts are listed, verify accounts are documented and approved for the WITH GRANT option. If non-DBA interactive user or application accounts have WITH GRANT without being documented and approved, this is a finding.

ℹ️ Check

Execute the query: select grantee||': '||owner||'.'||table_name from dba_tab_privs where grantable = 'YES' and grantee not in (select distinct owner from dba_objects) and grantee not in (select grantee from dba_role_privs where granted_role = 'DBA') and table_name not like 'SYS_PLSQL_%' order by grantee; If any accounts are listed, verify accounts are documented and approved for the WITH GRANT option. If non-DBA interactive user or application accounts have WITH GRANT without being documented and approved, this is a finding.

✔️ Fix
Revoke privileges granted the WITH GRANT OPTION from non-DBA and accounts that do not own application objects or document the need for WITH GRANT OPTION and get approval. Re-grant privileges without specifying WITH GRANT OPTION. Note: Do not revoke the system-generated grants such as those found on SYS_PLSQL_% objects. They are system generated object types (aka ShadowTypes), created internally by Oracle when using the Pipelined Table Functions. This can result in (incorrect) compilation failures and/or invalidations when the users who are supposed to have access to the shadow types find themselves without access.

✔️ Fix

Revoke privileges granted the WITH GRANT OPTION from non-DBA and accounts that do not own application objects or document the need for WITH GRANT OPTION and get approval. Re-grant privileges without specifying WITH GRANT OPTION. Note: Do not revoke the system-generated grants such as those found on SYS_PLSQL_% objects. They are system generated object types (aka ShadowTypes), created internally by Oracle when using the Pipelined Table Functions. This can result in (incorrect) compilation failures and/or invalidations when the users who are supposed to have access to the shadow types find themselves without access.