What causes "error-room-is-abac-managed" in RocketChat/Rocket.Chat?

Re-enable the `ABAC_Enabled` setting and ensure the license includes the `abac` module.

RocketChat/Rocket.Chat · error · Error

error-room-is-abac-managed

error-room-is-abac-managed

Error message

error-room-is-abac-managed

What it means

Thrown by the `beforeAddUserToRoom` ABAC hook when a room is private (`t === 'p'`) AND has `abacAttributes` set, but ABAC is not effectively enabled — either the `ABAC_Enabled` setting is off or the license lacks the `abac` module. This guard prevents silently bypassing attribute-based access control on a room that was configured to require it.

Source

Thrown at apps/meteor/ee/server/hooks/abac/beforeAddUserToRoom.ts:18

import { Abac } from '@rocket.chat/core-services';
import { License } from '@rocket.chat/license';

import { beforeAddUserToRoom } from '../../../../server/hooks/rooms/beforeAddUserToRoom';
import { settings } from '../../../../server/settings';

beforeAddUserToRoom.patch(async (prev, users, room, actor) => {
	await prev(users, room, actor);

	const validUsers = users.filter(Boolean);
	// No need to check ABAC when theres no users or when room is not private or when room is not ABAC managed
	if (!validUsers.length || room.t !== 'p' || !room?.abacAttributes?.length) {
		return;
	}

	// Throw error (prevent add) if ABAC is disabled (setting, license) but room is ABAC managed
	if (!settings.get('ABAC_Enabled') || !License.hasModule('abac')) {
		throw new Error('error-room-is-abac-managed');
	}

	await Abac.checkUsernamesMatchAttributes(validUsers as string[], room.abacAttributes, room);
});

View on GitHub (pinned to f9d3ec372b)

Solutions

Re-enable the `ABAC_Enabled` setting and ensure the license includes the `abac` module.
If ABAC is intentionally disabled, remove `abacAttributes` from the affected private rooms so they are no longer treated as ABAC-managed.
Verify the license is active and provisioned with the ABAC entitlement.

Defensive patterns

Strategy: validation

Validate before calling

import { settings } from '../../../../server/settings';
import { License } from '../../license/license';

function abacEffectivelyEnabled(room: { t: string; abacAttributes?: unknown[] }): boolean {
	if (room.t !== 'p' || !room.abacAttributes?.length) return true; // not ABAC-managed
	return settings.get('ABAC_Enabled') && License.hasModule('abac');
}

Type guard

function isAbacManagedRoomError(e: unknown): boolean {
	return e instanceof Error && e.message === 'error-room-is-abac-managed';
}

Try / catch

try {
	await beforeAddUserToRoom.run(users, room, actor);
} catch (e) {
	if (e instanceof Error && e.message === 'error-room-is-abac-managed') {
		// room is ABAC-managed but ABAC is off — fix config or clear abacAttributes
	}
	throw e;
}

Prevention

Keep `ABAC_Enabled` and the `abac` license module active when ABAC-managed rooms exist.
Before disabling ABAC, clear `abacAttributes` from affected rooms.
Monitor license validity for the ABAC module.

When it happens

Trigger: Adding a user to a private room that has `abacAttributes` while `settings.get('ABAC_Enabled')` is falsy OR `License.hasModule('abac')` is false. The hook runs after the previous handler in the patch chain.

Common situations: License downgrade or expiry removed the ABAC module while ABAC-managed rooms still exist; an admin disabled `ABAC_Enabled` but did not migrate/clear `abacAttributes` off affected rooms; feature flag toggled off in error.

Related errors

AI-assisted analysis of RocketChat/Rocket.Chat@f9d3ec372b (2026-08-12). Data as JSON: /api/errors/a0620284444e45a0. Report an issue: GitHub.