apache/superset · error · DashboardForbiddenError

Changing this Dashboard is forbidden

Error message

Changing this Dashboard is forbidden

What it means

DashboardForbiddenError ('Changing this Dashboard is forbidden') raised at the top of DashboardDAO.copy_dashboard: security_manager.is_editor(original_dash) returned False. Duplicating a dashboard is treated as a write-ish operation requiring editor rights on the source, checked before any clone rows are created.

Source

Thrown at superset/daos/dashboard.py:485

    def favorited_ids(dashboards: list[Dashboard]) -> list[FavStar]:
        ids = [dash.id for dash in dashboards]
        return [
            star.obj_id
            for star in db.session.query(FavStar.obj_id)
            .filter(
                FavStar.class_name == FavStarClassName.DASHBOARD,
                FavStar.obj_id.in_(ids),
                FavStar.user_id == get_user_id(),
            )
            .all()
        ]

    @classmethod
    def copy_dashboard(
        cls, original_dash: Dashboard, data: dict[str, Any]
    ) -> Dashboard:
        if not security_manager.is_editor(original_dash):
            raise DashboardForbiddenError()

        dash = Dashboard()
        # The copied dashboard and every chart cloned below share one creator,
        # so both lookups are resolved here rather than inside the loop, where
        # they would cost two extra queries for each chart in the dashboard.
        creator_editors: list[Any] = []
        creator_viewers: list[Any] = []
        if g.user:
            from superset.subjects.utils import (
                get_default_viewers_for_new_asset,
                get_user_subject,
            )

            user_subject = get_user_subject(g.user.id)
            creator_editors = [user_subject] if user_subject else []
            creator_viewers = get_default_viewers_for_new_asset(g.user.id)
        dash.editors = creator_editors
        dash.viewers = creator_viewers

View on GitHub (pinned to f4587218dd)

Solutions

1. Have an owner add the user (or their role) as an editor on the source dashboard, then retry the copy.
2. Ask an editor/admin to perform the duplication and transfer ownership of the clone.
3. If policy should allow viewer-forks, grant the role the write-dashboard capability — an operator decision, not a code fix.

from superset import security_manager

def can_copy(user, dash) -> bool:
    return bool(user is not None and security_manager.is_editor(dash))

try:
    clone = DashboardDAO.copy_dashboard(dash, data)
except DashboardForbiddenError:
    return jsonify({"error": "editor rights on the source dashboard required"}), 403

When it happens

Trigger: POST to duplicate/copy a dashboard (dashboard copy API or UI 'Duplicate') as a user who can view but not edit the source dashboard — not an owner, not in its editor roles, and lacking a global can-write-dashboard capability.

Common situations: Viewers attempting to fork a shared dashboard; service accounts used for automation that were granted only read; ownership transferred away and the previous owner's role loses editor rights.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Changing this Dashboard is forbidden
• You don't have access to this dashboard.
• Cannot convert node type: ${node.type}
• Changing this Dashboard is forbidden
• User doesn't have permission to create or update datasets

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/701bc9cd658a4578. Report an issue: GitHub.