{"record":{"id":"a1ea926e7aff4166","repo":"apache/cassandra","slug":"you-are-not-authorized-to-view-superuser-details","errorCode":null,"errorMessage":"You are not authorized to view superuser details","messagePattern":"You are not authorized to view superuser details","errorType":"validation","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/ListSuperUsersStatement.java","lineNumber":72,"sourceCode":"\n    public ListSuperUsersStatement()\n    {\n        // nothing to do\n    }\n\n    public void validate(ClientState state) throws UnauthorizedException, InvalidRequestException\n    {\n        state.ensureNotAnonymous();\n    }\n\n    public void authorize(ClientState state) throws InvalidRequestException\n    {\n        // Allow listing superuser privileged users only if the caller has DESCRIBE permission on 'all roles'\n        if (!DatabaseDescriptor.getAuthorizer()\n                               .authorize(state.getUser(), RoleResource.root())\n                               .contains(Permission.DESCRIBE))\n        {\n            throw new UnauthorizedException(\"You are not authorized to view superuser details\");\n        }\n    }\n\n    public ResultMessage execute(ClientState state) throws RequestValidationException, RequestExecutionException\n    {\n        Set<RoleResource> superUsers = Roles.getAllRoles(Roles::hasSuperuserStatus);\n        if (superUsers == null || superUsers.isEmpty())\n            return new ResultMessage.Void();\n\n        ResultSet result = new ResultSet(new ResultSet.ResultMetadata(metadata));\n\n        superUsers.stream()\n                  .sorted(RoleResource::compareTo)\n                  .forEach(role -> result.addColumnValue(UTF8Type.instance.decompose(role.getRoleName())));\n\n        return new ResultMessage.Rows(result);\n    }\n","sourceCodeStart":54,"sourceCodeEnd":90,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/ListSuperUsersStatement.java#L54-L90","documentation":"LIST SUPERUSERS requires the caller to hold DESCRIBE permission on the root role resource ('all roles'); the authorize() check throws UnauthorizedException otherwise. This limits visibility of superuser accounts to privileged roles.","triggerScenarios":"Any authenticated user without DESCRIBE on RoleResource.root() executes LIST SUPERUSERS (authorizer must return a permission set for root that lacks DESCRIBE).","commonSituations":"Regular application roles running LIST SUPERUSERS during debugging; monitoring scripts using under-privileged credentials; clusters on AllowAllAuthorizer migrated to CassandraAuthorizer where permissions were never granted.","solutions":["Have a superuser run: GRANT DESCRIBE ON ALL ROLES TO <user>, then retry","Run LIST SUPERUSERS with superuser credentials","Query via a role that is part of the superuser chain instead"],"exampleFix":"// before\nLIST SUPERUSERS; // as app_user -> UnauthorizedException\n// after\n-- as superuser\nGRANT DESCRIBE ON ALL ROLES TO app_user;\n-- then as app_user\nLIST SUPERUSERS;","handlingStrategy":"validation","validationCode":"boolean hasDescribe = DatabaseDescriptor.getAuthorizer()\n    .authorize(user, RoleResource.root()).contains(Permission.DESCRIBE);\nif (!hasDescribe) throw new IllegalStateException(\"LIST SUPERUSERS requires DESCRIBE on all roles\");","typeGuard":null,"tryCatchPattern":"try { session.execute(\"LIST SUPERUSERS\"); } catch (UnauthorizedException e) { log.warn(\"insufficient permissions for LIST SUPERUSERS: {}\", e.getMessage()); }","preventionTips":["Use a privileged (superuser or DESCRIBE-granted) account for superuser listings","Grant DESCRIBE ON ALL ROLES to monitoring/ops roles deliberately","Re-check permissions after authorizer migrations (e.g. to CassandraAuthorizer)"],"tags":["cassandra","cql","authorization","superuser","roles"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}