{"record":{"id":"b8cd506cca23b13d","repo":"apache/cassandra","slug":"you-are-not-authorized-to-view-s-s-permissions","errorCode":null,"errorMessage":"You are not authorized to view %s's permissions","messagePattern":"You are not authorized to view (.+?)'s permissions","errorType":"exception","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/auth/CassandraAuthorizer.java","lineNumber":344,"sourceCode":"                authWriteConsistencyLevel());\n    }\n\n    // 'grantee' can be null - in that case everyone's permissions have been requested. Otherwise, only single user's.\n    // If the 'performer' requesting 'LIST PERMISSIONS' is not a superuser OR their username doesn't match 'grantee' OR\n    // they have no permission to describe all roles OR they have no permission to describe 'grantee', then we throw\n    // UnauthorizedException.\n    public Set<PermissionDetails> list(AuthenticatedUser performer,\n                                       Set<Permission> permissions,\n                                       IResource resource,\n                                       RoleResource grantee)\n    throws RequestValidationException, RequestExecutionException\n    {\n        if (!performer.isSuper()\n            && !performer.isSystem()\n            && !performer.getRoles().contains(grantee)\n            && !performer.getPermissions(RoleResource.root()).contains(Permission.DESCRIBE)\n            && (grantee == null || !performer.getPermissions(grantee).contains(Permission.DESCRIBE)))\n            throw new UnauthorizedException(String.format(\"You are not authorized to view %s's permissions\",\n                                                          grantee == null ? \"everyone\" : grantee.getRoleName()));\n\n        if (null == grantee)\n            return listPermissionsForRole(permissions, resource, null);\n\n        Set<RoleResource> roles = DatabaseDescriptor.getRoleManager().getRoles(grantee, true);\n        Set<PermissionDetails> details = new HashSet<>();\n        for (RoleResource role : roles)\n            details.addAll(listPermissionsForRole(permissions, resource, role));\n\n        return details;\n    }\n\n    private Set<PermissionDetails> listPermissionsForRole(Set<Permission> permissions,\n                                                          IResource resource,\n                                                          RoleResource role)\n    throws RequestExecutionException\n    {","sourceCodeStart":326,"sourceCodeEnd":362,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/auth/CassandraAuthorizer.java#L326-L362","documentation":"Thrown by CassandraAuthorizer.list when a LIST PERMISSIONS request targets another user's permissions but the performer is not a superuser, is not the grantee, and lacks the DESCRIBE permission on the target role (or on all roles). It is a privilege check on the metadata request, not a failure of the underlying data.","triggerScenarios":"Thrown at src/java/org/apache/cassandra/auth/CassandraAuthorizer.java:344 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Run LIST PERMISSIONS as a superuser","List only the performer's own permissions (omit the OF clause or use their own role)","Grant the performer DESCRIBE on the target role (or ALL ROLES) so the metadata is visible"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}