Why is Oracle letting me do this? Security issue?

Step 1. I have created two tables, A and B. Step 2. I create some trigger on A which fires after insert or update on A and writes something to B.
Step 3. I grant select, insert, update on table A to user X. Step 4. I grant select only on table B to user X.

Now, when user X does an insert or an update on table A, the trigger fires and something gets written to table B. Even though no permission has been granted to user X for inserting or updating on table B.

It appears that triggers bypass the permission checks on a table. Unless I am missing something, this is a potentially dangerous situation, since there is nothing to prevent a user from accessing table B using this technique. Received on Fri Apr 09 1999 - 00:27:53 CDT