Skip to main content

SEC.PRIV.GRANT_OPTION_STRUCTURAL — It can hand on the power to change the schema

  • Category: security
  • Severity: high
  • Level: 0
  • Confidence: deterministic
  • Downtime class: none — the finding is about a grant, not about a statement
  • Stability: stable
  • Suites: audit
  • Applies to: PostgreSQL 18 · MySQL 8.4

Why this is a different sentence, not a worse degree​

A re-grantable data privilege widens who can read or write what exists. A re-grantable structural one widens who decides what exists at all — including who may create objects that a later audit has no particular reason to look at twice.

That is why it is a separate rule rather than the same one at a higher severity: the two have different fixes and belong in different places on a work list.

Bad​

-- Not just access to the data — the power to decide what exists.
GRANT CREATE ON shop.* TO 'app'@'10.0.0.%' WITH GRANT OPTION;

Good​

-- Structural rights stay with the account that deploys migrations…
GRANT CREATE ON shop.* TO 'deploy'@'10.0.0.%';

-- …and the application account keeps only what it uses at run time.
GRANT SELECT, INSERT, UPDATE, DELETE ON shop.* TO 'app'@'10.0.0.%';

The legitimate case, and why the fix costs nothing anyway​

A migration or deployment account holding structural rights is common and usually deliberate — it is the account whose job is to change the schema. An application account holding them is almost never intended.

Either way, REVOKE GRANT OPTION FOR takes back only the ability to hand the privilege on. The account keeps working exactly as it did, which means this finding can be acted on even where the underlying grant is correct.

How "structural" is decided​

From the reading's own classification of the privilege, not re-derived here. That matters for consistency rather than for tidiness: other rules already use the same flag, so one grant cannot be structural to this rule and ordinary to another.

What is not reported​

The same exclusions as its sibling: a grant the engine ships, and a grant that could not be read in full — the latter as undetermined, never as a clean bill.