BookStackApp/BookStack · error · PermissionsException

User does not have permission to create a page within the ne

Error message

User does not have permission to create a page within the new parent

What it means

PageRepo::move checks userCan(Permission::PageCreate, $parent) after validating the destination Book/Chapter. If the current user cannot create pages within the new parent, it throws PermissionsException('User does not have permission to create a page within the new parent'). Destination create permission is required in addition to the parent existing.

Source

Thrown at app/Entities/Repos/PageRepo.php:283

    }

    /**
     * Move the given page into a new parent book or chapter.
     * The $parentIdentifier must be a string of the following format:
     * 'book:<id>' (book:5).
     *
     * @throws MoveOperationException
     * @throws PermissionsException
     */
    public function move(Page $page, string $parentIdentifier): Entity
    {
        $parent = $this->entityQueries->findVisibleByStringIdentifier($parentIdentifier);
        if (!$parent instanceof Chapter && !$parent instanceof Book) {
            throw new MoveOperationException('Book or chapter to move page into not found');
        }

        if (!userCan(Permission::PageCreate, $parent)) {
            throw new PermissionsException('User does not have permission to create a page within the new parent');
        }

        return (new DatabaseTransaction(function () use ($page, $parent) {
            $page->chapter_id = ($parent instanceof Chapter) ? $parent->id : null;
            $newBookId = ($parent instanceof Chapter) ? $parent->book->id : $parent->id;
            $this->parentChanger->changeBook($page, $newBookId);
            $page->rebuildPermissions();

            Activity::add(ActivityType::PAGE_MOVE, $page);

            $this->baseRepo->sortParent($page);

            return $parent;
        }))->run();
    }

    /**
     * Get a new priority for a page.

View on GitHub (pinned to 18f8469a1c)

Solutions

1. Grant 'Create page' permission to the user's role or add a restriction on the target book/chapter.
2. Run the move as a privileged account/token.
3. Pre-check userCan(Permission::PageCreate, $parent) and disable the move UI/abort early when false.
4. Catch PermissionsException and display an explanatory message.

Example fix

// before
$pageRepo->move($page, $parentId);
// after
$parent = $entityQueries->findVisibleByStringIdentifier($parentId);
if (!userCan(\BookStack\Permissions\Permission::PageCreate, $parent)) {
    return back()->with('error', 'You cannot create pages in that location');
}
$pageRepo->move($page, $parentId);

$parent = $entityQueries->findVisibleByStringIdentifier($identifier);
if ($parent && !userCan(\BookStack\Permissions\Permission::PageCreate, $parent)) {
    abort(403, 'Missing page-create permission on target parent');
}

try {
    $pageRepo->move($page, $identifier);
} catch (\BookStack\Exceptions\PermissionsException $e) {
    return back()->with('error', $e->getMessage());
}

When it happens

Trigger: move($page, $parentIdentifier) executed by a user lacking 'page-create' via role permission or per-entity restrictions on the target Book/Chapter — even if they can view it.

Common situations: API tokens with read-only or limited scopes running import/move automation; roles where users can view but not create content in another's book; chapter-level restrictions; permission model changes after an upgrade.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• User does not have permission to create a chapter within the
• errors.chapter_not_found
• errors.page_not_found
• errors.api_user_no_api_permission
• Book to move chapter into not found

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/f40b9feceda3e86e. Report an issue: GitHub.