SQLGrantAdminWarn

Last updated: January 22, 2026

Identifies highly sensitive GRANT statements that include WITH ADMIN OPTION, which allows recipients to grant and revoke the same administrative privileges to others, helping prevent security risks from uncontrolled admin role distribution.

Uses

Property

Value

Liquibase version required

4.6.0+

Scope (--checks-scope)

changelog

Default status

enabled

Default severity (exit code)

0 ("INFO")

Customizable settings

No (static)

Note: SQLGrantAdminWarn only supports unmodeled changeset types. If you use this Policy Check with modeled changesets (XML, JSON, and YAML changelogs as well as all ChangeTypes except sql and sqlFile), a message will appear stating the changeset was skipped.

Before you begin

  1. Ensure that you have correctly specified your Liquibase Secure license key.

  2. Ensure that the --checks-scope parameter includes the scope of this check.

Changelog checks prerequisites

loading

loading

loading

loading

loading

Procedure

1

Enable

This check is enabled by default. To verify that it is currently enabled, run the checks show command:

liquibase checks show --check-name=<string>

2

To run the check, use the checks run command.

loading

loading

Note: For flow files you'll need to run liquibase flow to apply your changes.