{"record":{"id":"7a52024a91e99ab1","repo":"apache/cassandra","slug":"only-superusers-are-allowed-to-alter-superuser-sta","errorCode":null,"errorMessage":"Only superusers are allowed to alter superuser status","messagePattern":"Only superusers are allowed to alter superuser status","errorType":"validation","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java","lineNumber":107,"sourceCode":"        // validate login here before authorize, to avoid leaking user existence to anonymous users.\n        state.ensureNotAnonymous();\n        if (!DatabaseDescriptor.getRoleManager().isExistingRole(role))\n        {\n            checkTrue(ifExists, \"Role %s doesn't exist\", role.getRoleName());\n        }\n    }\n\n    public void authorize(ClientState state) throws UnauthorizedException\n    {\n        AuthenticatedUser user = state.getUser();\n        boolean isSuper = user.isSuper();\n\n        if (opts.getSuperuser().isPresent() && user.getRoles().contains(role))\n            throw new UnauthorizedException(\"You aren't allowed to alter your own superuser \" +\n                                            \"status or that of a role granted to you\");\n\n        if (opts.getSuperuser().isPresent() && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter superuser status\");\n\n        if (dcPermissions != null && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter access to datacenters.\");\n\n        if (cidrPermissions != null && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter access from CIDR groups.\");\n\n        // superusers can do whatever else they like\n        if (isSuper)\n            return;\n\n        // a role may only modify the subset of its own attributes as determined by IRoleManager#alterableOptions\n        if (user.getName().equals(role.getRoleName()))\n        {\n            for (Option option : opts.getOptions().keySet())\n            {\n                if (!DatabaseDescriptor.getRoleManager().alterableOptions().contains(option))\n                    throw new UnauthorizedException(String.format(\"You aren't allowed to alter %s\", option));","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java#L89-L125","documentation":"AlterRoleStatement.authorize rejects statements that set the SUPERUSER option when the authenticated user is not a superuser. Only superusers may change superuser status of any role, even one they have ALTER permission on.","triggerScenarios":"ALTER ROLE x WITH SUPERUSER = ... (or ALTER USER x SUPERUSER ...) executed by a non-super user, where the first self/granted-role check already passed (target role not among user's roles).","commonSituations":"Non-super DBA accounts attempting to promote a role; ops scripts using a service account lacking superuser; confusion between ALTER permission and superuser-only option restrictions.","solutions":["Perform the ALTER as a superuser account","Split the ALTER: apply non-superuser options as the current user, and ask a superuser to change SUPERUSER status","Grant superuser to the operating role only if policy allows"],"exampleFix":"// before (non-super user)\nALTER ROLE app_role WITH SUPERUSER = true;\n// after: run as superuser, or drop the option\nALTER ROLE app_role WITH LOGIN = true;","handlingStrategy":"validation","validationCode":"// pre-check caller is superuser before setting SUPERUSER\nif (settingSuperuser && !currentUser.isSuper())\n    throw new IllegalStateException(\"SUPERUSER option requires a superuser account\");","typeGuard":null,"tryCatchPattern":"try { session.execute(alterRoleCql); } catch (UnauthorizedException e) { if (e.getMessage().contains(\"Only superusers are allowed to alter superuser status\")) { /* rerun with superuser credentials */ } else throw e; }","preventionTips":["Use superuser credentials for role-status automation","Keep SUPERUSER assignments out of non-super admin runbooks","Audit scripts for ALTER ... SUPERUSER clauses and their executors"],"tags":["auth","security","roles"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}