Tracker / CVE-2025-23015
CVE-2025-23015
High 8.8
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches. This issue affects Apache Cassandra through 3.0.30, 3.11.17, 4.0.15, 4.1.7, 5.0.2. Users are recommended to upgrade to versions 3.0.31, 3.11.18, 4.0.16, 4.1.8, 5.0.3, which fixes the issue.
Affected products and versions
| apache | cassandra · 3.0.0 → 3.0.31 |
|---|---|
| apache | cassandra · 3.1 → 3.11.18 |
| apache | cassandra · 4.0.0 → 4.0.16 |
| apache | cassandra · 4.1.0 → 4.1.8 |
| apache | cassandra · 5.0.0 → 5.0.3 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.