{"record":{"id":"9bd07a6067b097cd","repo":"apache/cassandra","slug":"you-aren-t-allowed-to-alter-s","errorCode":null,"errorMessage":"You aren't allowed to alter %s","messagePattern":"You aren't allowed to alter (.+?)","errorType":"validation","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java","lineNumber":125,"sourceCode":"            throw new UnauthorizedException(\"Only superusers are allowed to alter superuser status\");\n\n        if (dcPermissions != null && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter access to datacenters.\");\n\n        if (cidrPermissions != null && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter access from CIDR groups.\");\n\n        // superusers can do whatever else they like\n        if (isSuper)\n            return;\n\n        // a role may only modify the subset of its own attributes as determined by IRoleManager#alterableOptions\n        if (user.getName().equals(role.getRoleName()))\n        {\n            for (Option option : opts.getOptions().keySet())\n            {\n                if (!DatabaseDescriptor.getRoleManager().alterableOptions().contains(option))\n                    throw new UnauthorizedException(String.format(\"You aren't allowed to alter %s\", option));\n            }\n        }\n        else\n        {\n            // if not attempting to alter another role, ensure we have ALTER permissions on it\n            super.checkPermission(state, Permission.ALTER, role);\n        }\n    }\n\n    public ResultMessage execute(ClientState state) throws RequestValidationException, RequestExecutionException\n    {\n        if (ifExists && !DatabaseDescriptor.getRoleManager().isExistingRole(role))\n            return null;\n\n        if (opts.isGeneratedPassword())\n        {\n            String generatedPassword = Guardrails.passwordPolicy.generate(state, Map.of());\n            if (generatedPassword != null)","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java#L107-L143","documentation":"When a role alters itself, Cassandra only allows modifying the subset of attributes declared by IRoleManager#alterableOptions(). Attempting to set a non-alterable option (e.g. SUPERUSER or PASSWORD with certain role managers) on your own role raises this UnauthorizedException.","triggerScenarios":"Executing ALTER ROLE <own role name> WITH an option not contained in DatabaseDescriptor.getRoleManager().alterableOptions() — e.g. a role trying to make itself superuser (WITH SUPERUSER = true) or change an option the configured IRoleManager marks non-alterable.","commonSituations":"Users trying to self-escalate to superuser; using a custom IRoleManager implementation whose alterableOptions() set is narrower than expected; confusing self-alteration rules with altering other roles (which requires ALTER permission instead).","solutions":["Remove the disallowed option from the ALTER ROLE statement or apply it to another role you have ALTER permission on","Have a superuser perform the change (superusers bypass the alterableOptions subset check)","If using a custom IRoleManager, include the needed Option in alterableOptions()"],"exampleFix":"// before\nALTER ROLE myself WITH SUPERUSER = true;\n// after\n-- must be done by an existing superuser on your role\n-- (as superuser):\nALTER ROLE myself WITH SUPERUSER = true;","handlingStrategy":"try-catch","validationCode":"// only allow self-alteration of known-alterable options\njava.util.Set<Option> alterable = org.apache.cassandra.config.DatabaseDescriptor.getRoleManager().alterableOptions();\nif (targetRole.equals(currentUser) && !alterable.containsAll(requestedOptions)) throw new IllegalArgumentException(\"option not alterable on self\");","typeGuard":null,"tryCatchPattern":"try { session.execute(alterCql); }\ncatch (com.datastax.driver.core.exceptions.UnauthorizedException e) {\n    if (e.getMessage().startsWith(\"You aren't allowed to alter\")) { /* request a superuser to apply the change */ }\n}","preventionTips":["Never attempt self-escalation (SUPERUSER on self); it is always rejected","Consult the configured IRoleManager's alterableOptions before building self-alter statements"],"tags":["cql","authorization","roles"],"backgroundTag":"insufficient-permissions","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}