{"id":"CVE-2023-33972","aliases":["BIT-scylladb-2023-33972","EUVD-2023-38098","GHSA-ww5v-p45p-3vhq"],"status":"published","title":"Privilege escalation from having CREATE access on a keyspace in Scylladb","description":"Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue has not yet been patched. A workaround to address this issue is to disable CREATE privileges on a keyspace, and create new tables on behalf of other users.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00641,"percentile":0.51014,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-269"],"published":"2023-09-27T18:15:18Z","modified":"2026-10-28T02:31:01Z","fixes":[{"ecosystem":"Bitnami","package":"scylladb","fixed_in":["5.2.9"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"scylladb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.2.9"}]}]}],"products":[{"vendor":"scylladb","product":"scylladb"}],"references":[{"url":"https://github.com/scylladb/scylladb/security/advisories/GHSA-ww5v-p45p-3vhq","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33972","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33972.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-33972","title":"Privilege escalation from having CREATE access on a keyspace in Scylladb","description":"Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue has not yet been patched. A workaround to address this issue is to disable CREATE privileges on a keyspace, and create new tables on behalf of other users.","status":"published","published":"2023-09-27T18:15:18.162Z","modified":"2024-09-23T19:08:40.769Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:35:34.55015Z"}],"euvd":[{"id":"EUVD-2023-38098","description":"Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue has not yet been patched. A workaround to address this issue is to disable CREATE privileges on a keyspace, and create new tables on behalf of other users.","status":"published","published":"2023-09-27T18:15:18Z","modified":"2024-09-23T19:08:40Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:28:16.548139Z"}],"nvd":[{"id":"CVE-2023-33972","description":"Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue has not yet been patched. A workaround to address this issue is to disable CREATE privileges on a keyspace, and create new tables on behalf of other users.","status":"published","published":"2023-09-27T19:15:11.497Z","modified":"2026-06-17T06:02:37.87Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:08:31.699785Z"}],"osv":[{"id":"CVE-2023-33972","title":"Privilege escalation from having CREATE access on a keyspace in Scylladb","description":"Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue has not yet been patched. A workaround to address this issue is to disable CREATE privileges on a keyspace, and create new tables on behalf of other users.","status":"published","published":"2023-09-27T18:15:18.162Z","modified":"2026-10-28T02:31:01.87355267Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:44:32.116263Z"},{"id":"BIT-scylladb-2023-33972","title":"Privilege escalation from having CREATE access on a keyspace in Scylladb","description":"Scylladb is a NoSQL data store using the seastar framework, compatible with Apache Cassandra. Authenticated users who are authorized to create tables in a keyspace can escalate their privileges to access a table in the same keyspace, even if they don't have permissions for that table. This issue has not yet been patched. A workaround to address this issue is to disable CREATE privileges on a keyspace, and create new tables on behalf of other users.","status":"published","published":"2024-05-14T14:38:04.732Z","modified":"2026-09-08T08:48:19.345219041Z","updated_at":"2026-11-02T15:28:35.111822Z"}]}}