CVE-2025-26467

Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra. An user with MODIFY permission ON ALL KEYSPACES can escalate privileges to superuser within a targeted Cassandra cluster via unsafe actions to a system resource. Operators granting data MODIFY permission on all keyspaces on affected versions should review data access rules for potential breaches. This issue affects Apache Cassandra 3.0.30, 3.11.17, 4.0.16, 4.1.7, 5.0.2, but this advisory is only for 4.0.16 because the fix to CVE-2025-23015 was incorrectly applied to 4.0.16, so that version is still affected. Users in the 4.0 series are recommended to upgrade to version 4.0.17 which fixes the issue. Users from 3.0, 3.11, 4.1 and 5.0 series should follow recommendation from CVE-2025-23015.

• CWE-267

• https://lists.apache.org/thread/xxj36rr4d6mzyqpld05dn8b9951hfpz7Mailing List, Vendor Advisory

Published

Aug 25, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-26461In Permission Manager, there is a possible way for the micro…3.3
• CVE-2025-26462In AccessibilityServiceConnection.java, there is a possible …7.8
• CVE-2025-26463In allowPackageAccess of multiple files, resource exhaustion…5.5
• CVE-2025-26464In executeAppFunction of AppSearchManagerService.java, there…7.8
• CVE-2025-26465A vulnerability was found in OpenSSH when the VerifyHostKeyD…6.8
• CVE-2025-26466A flaw was found in the OpenSSH package. For each ping packe…5.9
• CVE-2025-26468CyberData  011209 Intercom exposes features that could al…8.7
• CVE-2025-26469An incorrect default permissions vulnerability exists in the…9.8
• CVE-2025-2647A vulnerability was found in PHPGurukul Art Gallery Manageme…9.8
• CVE-2025-26470Incorrect default permissions for some Intel(R) Distribution…6.7
• CVE-2025-26471Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2025-26472Uncontrolled resource consumption for some Edge Orchestrator…5.9