What causes "Changing email is not allowed" in RocketChat/Rocket.Chat?

Enable Accounts_AllowEmailChange (Administration -> Accounts -> Email Change) if self-service email change is intended

RocketChat/Rocket.Chat · error · Meteor.Error

error-action-not-allowed

error-action-not-allowed

Error message

Changing email is not allowed

What it means

setEmailFunction refuses any email change when the workspace setting Accounts_AllowEmailChange is false. The check runs first - before the same-address early-return - so even resubmitting the user's current email throws while the setting is off.

Source

Thrown at apps/meteor/server/meteor-methods/users/setEmail.ts:22

import { Meteor } from 'meteor/meteor';

import { RateLimiterClass as RateLimiter } from '../../lib/RateLimiter';
import { methodDeprecationLogger } from '../../lib/deprecationWarningLogger';
import { setEmail } from '../../lib/users/setEmail';
import { settings } from '../../settings';

declare module '@rocket.chat/ddp-client' {
	// eslint-disable-next-line @typescript-eslint/naming-convention
	interface ServerMethods {
		setEmail(email: string): string;
	}
}

export const setEmailFunction = async (email: string, user: Meteor.User | IUser) => {
	check(email, String);

	if (!settings.get('Accounts_AllowEmailChange')) {
		throw new Meteor.Error('error-action-not-allowed', 'Changing email is not allowed', {
			method: 'setEmail',
			action: 'Changing_email',
		});
	}

	if (user.emails?.[0]?.address === email) {
		return email;
	}

	if (!(await setEmail(user._id, email))) {
		throw new Meteor.Error('error-could-not-change-email', 'Could not change email', {
			method: 'setEmail',
		});
	}

	return email;
};

View on GitHub (pinned to b2c16d5842)

Solutions

Enable Accounts_AllowEmailChange (Administration -> Accounts -> Email Change) if self-service email change is intended
Hide or disable the email field in the UI when the setting is false (it ships in the client's public settings)
For supported programmatic flows prefer the REST endpoint /v1/users.updateOwnBasicInfo or admin /v1/users.update

Defensive patterns

Strategy: validation

Validate before calling

const allowEmailChange = publicSettings['Accounts_AllowEmailChange'] === true;
if (!allowEmailChange) {
  disableField('email'); // do not even include email in the payload
}

Try / catch

catch (err) {
  if (err instanceof Meteor.Error && err.error === 'error-action-not-allowed' && err.details?.action === 'Changing_email') {
    showNotice('Email change is disabled on this server');
  }
}

Prevention

Read Accounts_AllowEmailChange from public settings and hide the email field when false
Remember the setting is checked before the same-email short-circuit - resubmitting an unchanged email still throws
For managed flows use /v1/users.updateOwnBasicInfo or admin users.update

When it happens

Trigger: saveUserProfile (which delegates to setEmailFunction when settings.email is set) or setEmail itself, called with any email value while Accounts_AllowEmailChange is disabled under Administration > Accounts.

Common situations: Fresh installs where email change is off by default; LDAP/OAuth-managed workspaces that intentionally lock email addresses; a profile UI that still shows an editable email field although the server forbids changes.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/abb28689656b970c. Report an issue: GitHub.