Merge pull request #35878 from loicmaz/patch-1

Update cross-db-ownership-chaining-server-configuration-option.md

Author: prmerger-automator[bot]

docs/database-engine/configure-windows/cross-db-ownership-chaining-server-configuration-option.md

@@ -3,7 +3,7 @@ title: "Server Configuration: cross db ownership chaining"
 description: "Learn how to use the cross db ownership chaining option in SQL Server. View considerations for turning cross-database ownership chaining on and off."
 author: rwestMSFT
 ms.author: randolphwest
-ms.date: 08/26/2025
+ms.date: 11/19/2025
 ms.service: sql
 ms.subservice: configuration
 ms.topic: conceptual
@@ -33,7 +33,9 @@ This server option allows you to control cross-database ownership chaining at th
 To determine the current status of cross-database ownership chaining, execute the following query:
 
 ```sql
-SELECT is_db_chaining_on, name FROM sys.databases;
+SELECT is_db_chaining_on,
+       name
+FROM sys.databases;
 ```
 
 A result of `1` indicates that cross-database ownership chaining is enabled.
@@ -50,6 +52,12 @@ Before turning cross-database ownership chaining on or off:
 
 - If you have databases that require cross-database ownership chaining, the recommended practice is to turn off the `cross db ownership chaining` option for the instance using `sp_configure`; then, turn on cross-database ownership chaining for individual databases that require it with the [ALTER DATABASE](../../t-sql/statements/alter-database-transact-sql.md) statement.
 
+## Security risk
+
+Enabling cross-database ownership chaining in [!INCLUDE [ssnoversion-md](../../includes/ssnoversion-md.md)] introduces a potential security vulnerability. When this feature is active, a local database user with elevated privileges can exploit ownership chaining to escalate permissions and potentially gain **sysadmin** access.
+
+You should avoid enabling cross-database ownership chaining at the instance level, and restrict its use to trusted, related databases only.
+
 ## Related content
 
 - [ALTER DATABASE (Transact-SQL)](../../t-sql/statements/alter-database-transact-sql.md)