{"record":{"id":"bd94fff6bfe91de9","repo":"apache/cassandra","slug":"user-s-does-not-have-sufficient-privileges-to-per","errorCode":null,"errorMessage":"User %s does not have sufficient privileges to perform the requested operation","messagePattern":"User (.+?) does not have sufficient privileges to perform the requested operation","errorType":"validation","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/AuthenticationStatement.java","lineNumber":64,"sourceCode":"    public abstract ResultMessage execute(ClientState state) throws RequestExecutionException, RequestValidationException;\n\n    @Override\n    public ResultMessage executeLocally(QueryState state, QueryOptions options)\n    {\n        // executeLocally is for local query only, thus altering users doesn't make sense and is not supported\n        throw new UnsupportedOperationException();\n    }\n\n    public void checkPermission(ClientState state, Permission required, RoleResource resource) throws UnauthorizedException\n    {\n        try\n        {\n            state.ensurePermission(required, resource);\n        }\n        catch (UnauthorizedException e)\n        {\n            // Catch and rethrow with a more friendly message\n            throw new UnauthorizedException(String.format(\"User %s does not have sufficient privileges \" +\n                                                          \"to perform the requested operation\",\n                                                          state.getUser().getName()));\n        }\n    }\n\n    public String obfuscatePassword(String query)\n    {\n        return query;\n    }\n}\n\n","sourceCodeStart":46,"sourceCodeEnd":76,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/AuthenticationStatement.java#L46-L76","documentation":"AuthenticationStatement.checkPermission catches the underlying UnauthorizedException from state.ensurePermission and rethrows it as a friendlier message naming the user, hiding resource/permission specifics. It means the authenticated user lacks the required Permission on the resource.","triggerScenarios":"Any auth-related CQL statement (CREATE/ALTER/DROP ROLE or USER, GRANT/REVOKE, LIST permissions) whose checkPermission finds the user lacks the required permission on the target resource — e.g. ALTER on a role you don't own without explicit ALTER permission.","commonSituations":"Granting a role ALTER on some resources but not the target; typo in role name causing permission lookup against wrong resource; permission caches stale after REVOKE (use LIST ALL PERMISSIONS OF user to audit).","solutions":["Grant the required permission: a superuser runs GRANT ALTER ON ROLE <role> TO <user> (or the appropriate permission/resource)","Perform the operation as a superuser","Audit the user's effective permissions with LIST ALL PERMISSIONS OF <user> and adjust grants"],"exampleFix":"// before\nALTER ROLE other_role WITH PASSWORD = 'x'; // UnauthorizedException\n// after\n-- as superuser first:\nGRANT ALTER ON ROLE other_role TO my_admin;\n-- then as my_admin:\nALTER ROLE other_role WITH PASSWORD = 'x';","handlingStrategy":"try-catch","validationCode":"// pre-check effective permissions\nResultSet rs = session.execute(\"LIST ALL PERMISSIONS OF \" + user);\nboolean allowed = rs.all().stream().anyMatch(row -> row.getString(\"permission\").equals(\"ALTER\") && resourceMatches(row, resource));","typeGuard":null,"tryCatchPattern":"try { session.execute(stmt); }\ncatch (com.datastax.driver.core.exceptions.UnauthorizedException e) {\n    if (e.getMessage().contains(\"does not have sufficient privileges\")) { auditGrants(user); }\n}","preventionTips":["Run LIST ALL PERMISSIONS OF <user> to audit grants before privileged operations","Grant the exact permission on the exact resource (GRANT ALTER ON ROLE x TO y)","Remember this handler masks the underlying resource detail — use server logs for diagnostics"],"tags":["cql","authorization","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}