O121-BP-022500 - Oracle roles granted using the WITH ADMIN OPTION must not be granted to unauthorized accounts.


The WITH ADMIN OPTION allows the grantee to grant a role to another database account. Best security practice restricts the privilege of assigning privileges to authorized personnel. Authorized personnel include DBAs, object owners, and, where designed and included in the application's functions, application administrators. Restricting privilege-granting functions to authorized accounts can help decrease mismanagement of privileges and wrongful assignments to unauthorized accounts.


Revoke assignment of roles with the WITH ADMIN OPTION from unauthorized grantees and re-grant them without the option if required.

SQL statements to remove the admin option from an unauthorized grantee:
revoke <role name> from <grantee>;
grant <role name> to <grantee>;

Restrict use of the WITH ADMIN OPTION to authorized administrators.

Document authorized role assignments with the WITH ADMIN OPTION in the System Security Plan.

See Also


Item Details


References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-219836r879887_rule, STIG-ID|O121-BP-022500, STIG-Legacy|SV-75927, STIG-Legacy|V-61437, Vuln-ID|V-219836

Plugin: OracleDB

Control ID: 1a744a3e8b53da25611f4e8506ccbbf026684c4b5df7c02054208c6505b40055