{"record":{"id":"081e1719143eb680","repo":"apache/cassandra","slug":"only-superusers-are-allowed-to-alter-access-from-c","errorCode":null,"errorMessage":"Only superusers are allowed to alter access from CIDR groups.","messagePattern":"Only superusers are allowed to alter access from CIDR groups\\.","errorType":"validation","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java","lineNumber":113,"sourceCode":"    }\n\n    public void authorize(ClientState state) throws UnauthorizedException\n    {\n        AuthenticatedUser user = state.getUser();\n        boolean isSuper = user.isSuper();\n\n        if (opts.getSuperuser().isPresent() && user.getRoles().contains(role))\n            throw new UnauthorizedException(\"You aren't allowed to alter your own superuser \" +\n                                            \"status or that of a role granted to you\");\n\n        if (opts.getSuperuser().isPresent() && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter superuser status\");\n\n        if (dcPermissions != null && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter access to datacenters.\");\n\n        if (cidrPermissions != null && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter access from CIDR groups.\");\n\n        // superusers can do whatever else they like\n        if (isSuper)\n            return;\n\n        // a role may only modify the subset of its own attributes as determined by IRoleManager#alterableOptions\n        if (user.getName().equals(role.getRoleName()))\n        {\n            for (Option option : opts.getOptions().keySet())\n            {\n                if (!DatabaseDescriptor.getRoleManager().alterableOptions().contains(option))\n                    throw new UnauthorizedException(String.format(\"You aren't allowed to alter %s\", option));\n            }\n        }\n        else\n        {\n            // if not attempting to alter another role, ensure we have ALTER permissions on it\n            super.checkPermission(state, Permission.ALTER, role);","sourceCodeStart":95,"sourceCodeEnd":131,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java#L95-L131","documentation":"Cassandra throws this UnauthorizedException when a non-superuser role attempts ALTER ROLE while specifying CIDR-group access (cidrPermissions). Only superusers may grant or revoke access from CIDR groups, as enforced in AlterRoleStatement.authorize.","triggerScenarios":"Executing ALTER ROLE ... WITH CIDR GROUPS ... (cidrPermissions != null) while logged in as a role whose isSuper() is false, even if that role has ALTER permission on the target role resource.","commonSituations":"A security admin role without superuser status tries to tighten or widen CIDR network restrictions for a role; role hierarchy assumptions (admin role assumed to be super) after migration from older Cassandra versions where CIDR permissions did not exist.","solutions":["Log in as (or grant superuser to, via an existing superuser) a superuser role before altering CIDR group access","Split the statement: perform non-CIDR attribute changes with the current role and delegate only CIDR changes to a superuser","Enable and configure CIDR authorization in cassandra.yaml and verify the executing role's superuser status with LIST ROLES"],"exampleFix":"// before\nALTER ROLE service_role WITH CIDR GROUPS = {'office_net'};\n// after\n-- run as superuser, e.g. cassandra or another super role\nALTER ROLE service_role WITH CIDR GROUPS = {'office_net'};","handlingStrategy":"try-catch","validationCode":"// before executing\nboolean isSuper = session.execute(\"LIST ROLES\").all().stream()\n    .filter(r -> r.getString(\"role\").equals(currentUser))\n    .anyMatch(AuthenticatedUser::isSuper); // or check via RoleResource\nif (!isSuper && cql.contains(\"CIDR GROUPS\")) throw new IllegalStateException(\"superuser required for CIDR changes\");","typeGuard":null,"tryCatchPattern":"try { session.execute(alterCql); }\ncatch (com.datastax.driver.core.exceptions.UnauthorizedException e) {\n    if (e.getMessage().contains(\"CIDR groups\")) { /* escalate to superuser session and retry */ }\n}","preventionTips":["Check LIST ROLES to confirm superuser status before altering CIDR groups","Keep CIDR group changes in a superuser-only operational runbook"],"tags":["cql","authorization","security"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}