CVE-2025-23015
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.
This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.
Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.
This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.
Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
- Record
CVE-2025-23015- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-267
- Updated
- 2026-11-02
EUVDEUVD-2025-0230
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.
This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.
Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
- Record
EUVD-2025-0230- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wmcc-9vch-jmx4
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.
This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.
Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
- Record
GHSA-wmcc-9vch-jmx4- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-267
- Updated
- 2026-11-02
NVD
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.
This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.
Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
- Record
CVE-2025-23015- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-267
- Updated
- 2026-11-02
OSV
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.
This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.
Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
- Record
CVE-2025-23015- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-267
- Updated
- 2026-11-02
OSVGHSA-wmcc-9vch-jmx4
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.
This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.
Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
- Record
GHSA-wmcc-9vch-jmx4- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-267
- Updated
- 2026-11-02
OSVAZL-56436 No score
CVE-2025-23015 affecting package cassandra 5.0.0-2
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.
This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.
Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
- Record
AZL-56436- Updated
- 2026-11-05
OSVAZL-56443 No score
CVE-2025-23015 affecting package cassandra 4.0.10-1
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.
This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.
Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
- Record
AZL-56443- Updated
- 2026-11-02
OSVBIT-cassandra-2025-23015 No score
Apache Cassandra: User with MODIFY permission on ALL KEYSPACES can escalate privileges to superuser via unsafe actions
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches.
This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2.
Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
- Record
BIT-cassandra-2025-23015- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.apache.cassandra:cassandra-allMaven |
5.0-alpha1 up to 5.0.3 | 5.0.3 |
org.apache.cassandra:cassandra-allMaven |
4.1-alpha1 up to 4.1.8 | 4.1.8 |
org.apache.cassandra:cassandra-allMaven |
4.0-alpha1 up to 4.0.16 | 4.0.16 |
org.apache.cassandra:cassandra-allMaven |
3.1 up to 3.11.18 | 3.11.18 |
org.apache.cassandra:cassandra-allMaven |
before 3.0.31 | 3.0.31 |
cassandraAzure Linux:3 |
through 5.0.0-2 | None known |
cassandraAzure Linux:2 |
through 4.0.10-1 | None known |
cassandraBitnami |
3.0.0 up to 3.0.31, 3.1.0 up to 3.11.18, 4.0.0 up to 4.0.16, 4.1.0 up to 4.1.8, 5.0.0 up to 5.0.3 | 3.0.313.11.184.0.164.1.85.0.3 |
org.apache.cassandra:cassandra-allMaven |
5.0-alpha1 up to 5.0.3, plus listed versions 5.0-alpha25.0-beta15.0-rc15.0-rc25.0.05.0.15.0.2 |
5.0.3 |
org.apache.cassandra:cassandra-allMaven |
4.1-alpha1 up to 4.1.8, plus listed versions 4.1-beta14.1-rc14.1.04.1.14.1.2 Show 5 moreShow less4.1.34.1.44.1.54.1.64.1.7 |
4.1.8 |
org.apache.cassandra:cassandra-allMaven |
4.0-alpha1 up to 4.0.16, plus listed versions 4.0-alpha24.0-alpha34.0-alpha44.0-beta14.0-beta2 Show 20 moreShow less4.0-beta34.0-beta44.0-rc14.0-rc24.0.04.0.14.0.104.0.114.0.124.0.134.0.144.0.154.0.24.0.34.0.44.0.54.0.64.0.74.0.84.0.9 |
4.0.16 |
org.apache.cassandra:cassandra-allMaven |
3.1 up to 3.11.18, plus listed versions 3.1.13.103.11.03.11.13.11.10 Show 24 moreShow less3.11.113.11.123.11.133.11.143.11.153.11.163.11.173.11.23.11.33.11.43.11.53.11.63.11.73.11.83.11.93.23.2.13.33.43.53.63.73.83.9 |
3.11.18 |
org.apache.cassandra:cassandra-allMaven |
before 3.0.31, plus listed versions 0.7.00.7.0-rc40.7.10.7.100.7.2 Show 45 moreShow less0.7.30.7.40.7.50.7.60.7.6-20.7.70.7.80.7.90.8.00.8.0-beta10.8.0-beta20.8.0-rc10.8.10.8.100.8.20.8.30.8.40.8.50.8.60.8.70.8.80.8.91.0.01.0.0-beta11.0.0-rc11.0.0-rc21.0.11.0.101.0.111.0.121.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.0-beta11.1.0-beta21.1.0-rc11.1.11.1.101.1.11 |
3.0.31 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-23015 is a high vulnerability (CVSS 8.8) in Apache Cassandra, published February 4, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.01%, the 63rd percentile. Fixed in org.apache.cassandra:cassandra-all 5.0.3.
References
lists.apache.org/thread/jmks4msbgkl65ssg69x728sv1m0hwz3s
openwall.com/lists/oss-security/2025/02/03/2
security.netapp.com/advisory/ntap-20250214-0006
nvd.nist.gov/vuln/detail/CVE-2025-23015
github.com/apache/cassandra/commit/6207a305ba2b0cebc3241e00a843ab5dbf86d2ed
Left out here: 147 versions. The JSON record has them.