{"record":{"id":"c52ec601940389ba","repo":"apache/cassandra","slug":"you-aren-t-allowed-to-alter-your-own-superuser-sta","errorCode":null,"errorMessage":"You aren't allowed to alter your own superuser status or that of a role granted to you","messagePattern":"You aren't allowed to alter your own superuser status or that of a role granted to you","errorType":"validation","errorClass":"UnauthorizedException","httpStatus":null,"severity":"error","filePath":"src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java","lineNumber":103,"sourceCode":"            // Ensure input CIDR group names are valid, i.e, existing in CIDR groups mapping table\n            cidrPermissions.validate();\n        }\n\n        // validate login here before authorize, to avoid leaking user existence to anonymous users.\n        state.ensureNotAnonymous();\n        if (!DatabaseDescriptor.getRoleManager().isExistingRole(role))\n        {\n            checkTrue(ifExists, \"Role %s doesn't exist\", role.getRoleName());\n        }\n    }\n\n    public void authorize(ClientState state) throws UnauthorizedException\n    {\n        AuthenticatedUser user = state.getUser();\n        boolean isSuper = user.isSuper();\n\n        if (opts.getSuperuser().isPresent() && user.getRoles().contains(role))\n            throw new UnauthorizedException(\"You aren't allowed to alter your own superuser \" +\n                                            \"status or that of a role granted to you\");\n\n        if (opts.getSuperuser().isPresent() && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter superuser status\");\n\n        if (dcPermissions != null && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter access to datacenters.\");\n\n        if (cidrPermissions != null && !isSuper)\n            throw new UnauthorizedException(\"Only superusers are allowed to alter access from CIDR groups.\");\n\n        // superusers can do whatever else they like\n        if (isSuper)\n            return;\n\n        // a role may only modify the subset of its own attributes as determined by IRoleManager#alterableOptions\n        if (user.getName().equals(role.getRoleName()))\n        {","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/apache/cassandra/blob/88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1/src/java/org/apache/cassandra/cql3/statements/AlterRoleStatement.java#L85-L121","documentation":"AlterRoleStatement.authorize rejects attempts by a user to change the SUPERUSER option of their own role, or of any role granted to them (directly or transitively via user.getRoles()). This closes a privilege-escalation path where a user could grant or revoke their own superuser status.","triggerScenarios":"ALTER ROLE myrole WITH SUPERUSER = true/false where the authenticated user's role set (user.getRoles()) contains the target role, regardless of whether the user is a superuser.","commonSituations":"Self-service scripts where admins alter their own account; a superuser who is also a member of the target role; automation credentials that share roles with the account being modified.","solutions":["Have a different (superuser) account that is not a grantee of the target role perform the ALTER","ALTER the role under a different name/admin role not granted to you","If self-modification is genuinely required, revoke the role grant from the operating user first (as another superuser)"],"exampleFix":"// before (as user granted 'admin')\nALTER ROLE admin WITH SUPERUSER = true;\n// after (from an unrelated superuser account)\nALTER ROLE admin WITH SUPERUSER = true;","handlingStrategy":"validation","validationCode":"// pre-check: target role must not be one of the caller's roles when changing SUPERUSER\nList<Role> myRoles = getGrantedRoles(currentUser);\nif (settingSuperuser && myRoles.stream().anyMatch(r -> r.name.equals(targetRole)))\n    throw new IllegalStateException(\"Cannot alter SUPERUSER status of own/granted role \" + targetRole);","typeGuard":null,"tryCatchPattern":"try { session.execute(alterRoleCql); } catch (UnauthorizedException e) { if (e.getMessage().contains(\"alter your own superuser status\")) { /* use another superuser account */ } else throw e; }","preventionTips":["Issue SUPERUSER changes from a dedicated admin account that holds no grants to target roles","Model separation of duties: provisioning accounts vs target roles","Document that self-service ALTER of own roles cannot touch SUPERUSER"],"tags":["auth","security","privilege-escalation"],"backgroundTag":"permission-denied","analyzedSha":"88fd0f6a0eaed8943f05ac9e8f947882b8ddc8f1","analyzedAt":"2026-09-10T07:29:22.284Z","contentChangedAt":"2026-09-10T07:29:22.284Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}