For those that are obliged to configure CMOD on ORACLE (for technology compliance reasons for example),
there is a step in the Installation Guide where you are told to grant DBA privilege to the CMOD schema.
After being challenged by internal Audit that DBA privilege should not be granted to applications, we traced CMOD activity to find that the least privileges required are:
-ALTER SYSTEM
-CREATE SESSION
-CREATE TABLE
We've been running CMOD on ORACLE with this least privilege set for almost 2 years without any issue, but I wonder if there is any CMOD feature we don't use (yet) that does require more expanded Oracle privileges.
