title: Bypass table privilege and WITH GRANT OPTION by creating views
body: <p>In Oracle, users only need privileges on view to be able to SELECT from it, more precisely, what the view see from the table. Privileges on table are not required.</p>
  
  <p>Let's consider this scenario :</p>
  
  <pre><code>Table T belongs to A
  A GRANT SELECT ON T to B (without GRANT OPTION)
  B CREATE VIEW V AS SELECT * FROM A.T
  B GRANT SELECT ON V TO C
  C performing SELECT * FROM B.V
  </code></pre>
  
  <p>According to the rule above, C will be able to select from V, therefore equivalent to selecting from T. Is that kind of cheating ? B is effectively letting C seeing A.T although C does not have the right on T and B does not have GRANT OPTION. Is there a security hole somewhere ?</p>