Mintplex-Labs/anything-llm · warning

Image not found or access denied

Error message

Image not found or access denied

What it means

Returned (HTTP 404) by GET /image-generation/generated-images/:filename when findFileSource(filename, {user, isMultiUser}) returns null — no workspace chat the requesting user can access (and, in single-user mode, no scheduled job run) references this image. As with the documents route, 'not found' and 'not permitted' are intentionally merged into one 404 so the endpoint does not leak which images exist for other users.

Source

Thrown at server/endpoints/agentFileServer.js:118

        const fs = require("fs");
        const path = require("path");
        const {
          generatedImagesPath,
          GENERATED_IMAGE_FILENAME_PATTERN,
        } = require("../utils/files");
        const user = await userFromSession(request, response);
        const { filename } = request.params;

        if (!filename || !GENERATED_IMAGE_FILENAME_PATTERN.test(filename))
          return response.status(400).json({ error: "Invalid filename" });

        const fileSource = await findFileSource(filename, {
          user,
          isMultiUser: multiUserMode(response),
        });
        if (!fileSource)
          return response
            .status(404)
            .json({ error: "Image not found or access denied" });

        const imagePath = path.resolve(generatedImagesPath, filename);
        let imageBuffer;
        try {
          imageBuffer = await fs.promises.readFile(imagePath);
        } catch {
          return response
            .status(404)
            .json({ error: "Image not found in storage" });
        }

        response.setHeader("Content-Type", "image/png");
        return response.send(imageBuffer);
      } catch (error) {
        console.error("[agentFileServer] Image serve error:", error.message);
        return response.status(500).json({ error: "Failed to serve image" });
      }

View on GitHub (pinned to 3aec848f28)

Solutions

1. Open the image from the chat that generated it, logged in as a user with access to that workspace
2. Verify frontend and backend share the same instance and database
3. Regenerate the image in an accessible chat if the original chat is gone

// Verify the requesting session owns a chat that references the image before rendering
const source = await findAccessibleChatFor(imageName);
if (!source) hideImageWithPlaceholder(); // do not request a URL that will 404

const res = await fetch(imgUrl, {credentials: 'include'});
if (res.status === 404) {
  // missing or denied — indistinguishable by design;
  // re-authenticate as the owning user or regenerate the image in an accessible chat
}

When it happens

Trigger: In multi-user mode, requesting an image generated in a chat owned by another user; an <img> src from a different instance/database than the one serving; the generating chat was deleted; the browser session resolved to a user without access to the originating workspace.

Common situations: Cross-user sharing of generated image URLs; frontend pointed at a backend whose database has no record of the image; bookmarked image URLs after workspace/chat cleanup; expired or switched login sessions.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• File not found or access denied
• Memory not found.
• Image not found in storage
• Workspace not found
• Image edit failed (${res.status}): ${body || res.statusText}

AI-assisted analysis of Mintplex-Labs/anything-llm@3aec848f28 (2026-08-18). Data as JSON: /api/errors/9e19017fd7c6a389. Report an issue: GitHub.