RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Not allowed

What it means

Thrown by 'saveUserProfile' when the setting Accounts_AllowUserProfileChange is false. It is a global feature gate checked before the user-id guard: with profile changes disabled workspace-wide, nobody (including the owner of the profile) may edit profile fields through this method. There is no per-user override permission at this checkpoint.

Source

Thrown at apps/meteor/server/meteor-methods/users/saveUserProfile.ts:43

async function saveUserProfile(
	this: AuthenticatedContext,
	settings: {
		email?: string;
		username?: string;
		realname?: string;
		newPassword?: string;
		statusText?: string;
		statusType?: string;
		bio?: string;
		nickname?: string;
	},
	customFields: Record<string, unknown>,
	..._: unknown[]
) {
	const unset: UpdateFilter<IUser> = {};
	if (!rcSettings.get<boolean>('Accounts_AllowUserProfileChange')) {
		throw new Meteor.Error('error-not-allowed', 'Not allowed', {
			method: 'saveUserProfile',
		});
	}

	if (!this.userId) {
		throw new Meteor.Error('error-invalid-user', 'Invalid user', {
			method: 'saveUserProfile',
		});
	}

	await validateUserEditing(this.userId, {
		_id: this.userId,
		email: settings.email,
		username: settings.username,
		name: settings.realname,
		password: settings.newPassword,
		statusText: settings.statusText,
	});

View on GitHub (pinned to b2c16d5842)

Solutions

1. If local profile edits should be allowed: enable Administration > Accounts > 'Allow User Profile Change'.
2. If profiles are IdP-managed: make the profile form read-only in your UI/fork instead of calling the method.
3. Admins needing to fix a profile can use PUT /api/v1/users.update with admin credentials, which is not blocked by this setting.

Example fix

// before: form always editable
{canEdit ? <ProfileForm onSubmit={saveUserProfile} /> : <ReadonlyProfile />}

// after: tie editability to the public setting
const canEdit = publicSettings['Accounts_AllowUserProfileChange'] === true;
{canEdit ? <ProfileForm onSubmit={saveUserProfile} /> : <ReadonlyProfile />}

const profileChangeAllowed = publicSettings['Accounts_AllowUserProfileChange'] === true;
if (!profileChangeAllowed) {
  renderReadOnlyProfile();
} else {
  renderEditableProfile({ onSubmit: saveUserProfile });
}

try {
  await Meteor.callAsync('saveUserProfile', settings, customFields);
} catch (e) {
  if ((e as Meteor.Error).error === 'error-not-allowed') {
    showError('Profile editing is disabled on this server.');
    renderReadOnlyProfile();
  }
}

When it happens

Trigger: Meteor.call('saveUserProfile', ...) or the account profile form while Administration > Accounts > 'Allow User Profile Change' is false; workspaces that sync profile data from LDAP/SAML and lock local edits.

Common situations: Directory-managed deployments locking name/email/username to the IdP; UI still rendering editable profile fields after the admin disabled changes.

Related errors

• error-user-registration-disabled
• error-not-allowed
• error-not-allowed
• error-message-size-exceeded
• error-not-allowed

AI-assisted analysis of RocketChat/Rocket.Chat@b2c16d5842 (2026-08-18). Data as JSON: /api/errors/a21c673a431801cf. Report an issue: GitHub.