RocketChat/Rocket.Chat · error · Meteor.Error

error-not-allowed

error-not-allowed

Error message

Change avatar is not allowed

What it means

Thrown by users.setAvatar when the workspace setting Accounts_AllowUserAvatarChange is false AND the caller has no edit-other-user-avatar permission. This is the global 'avatar changes are disabled' guard, raised before any user is resolved.

Source

Thrown at apps/meteor/server/api/v1/users.ts:291

		},
	)
	.post(
		'users.setAvatar',
		{
			authRequired: true,
			body: isUsersSetAvatarProps,
			response: {
				200: voidSuccessResponse,
				400: validateBadRequestErrorResponse,
				401: validateUnauthorizedErrorResponse,
				403: validateForbiddenErrorResponse,
			},
		},
		async function action() {
			const canEditOtherUserAvatar = await hasPermissionAsync(this.user, 'edit-other-user-avatar');

			if (!settings.get('Accounts_AllowUserAvatarChange') && !canEditOtherUserAvatar) {
				throw new Meteor.Error('error-not-allowed', 'Change avatar is not allowed', {
					method: 'users.setAvatar',
				});
			}

			let user = await (async (): Promise<Pick<IUser, '_id' | 'username'> | undefined | null> => {
				if (isUserFromParams(this.bodyParams, this.userId, this.user)) {
					return Users.findOneById(this.userId);
				}
				if (canEditOtherUserAvatar) {
					return getUserFromParams(this.bodyParams);
				}
			})();

			if (!user) {
				return API.v1.forbidden();
			}

			if (this.bodyParams.avatarUrl) {

View on GitHub (pinned to f9d3ec372b)

Solutions

1. An admin must enable Accounts_AllowUserAvatarChange, or grant the caller edit-other-user-avatar.
2. Use a different avatar source (URL/Gravatar) if uploads are disabled.
3. Confirm the policy with the workspace admin before attempting uploads.

Example fix

null

// Read the setting (exposed via settings.get public API) before showing the control
const allowed = await settingsPublic['Accounts_AllowUserAvatarChange'];
if (!allowed && !hasRole('edit-other-user-avatar')) hideAvatarUpload();

null

try {
  await POST('users.setAvatar', form);
} catch (e) {
  if (isMeteorError(e, 'error-not-allowed')) {
    // tell the user avatar changes are disabled by the admin
  } else { throw e; }
}

When it happens

Trigger: POST users.setAvatar on a workspace where the admin disabled Accounts_AllowUserAvatarChange, by a user who is not an avatar admin.

Common situations: Self-hosted workspace locked down avatars; admin toggled the setting after customisation; default policy in restricted deployments.

Related errors

• error-action-not-allowed
• error-two-factor-not-enabled
• error-status-not-allowed
• The setting "${id}" is not readable.
• The setting "${setting.id}" is not readable.

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/b50760eeefdfd47e. Report an issue: GitHub.