apache/superset · error · DashboardAccessDeniedError

You don't have access to this dashboard.

Error message

You don't have access to this dashboard.

What it means

DashboardAccessDeniedError ('You don't have access to this dashboard.') raised by DashboardDAO.get_by_id_or_slug: the row was found and passed the base filter, but the explicit security_manager-level check dashboard.raise_for_access() raised SupersetSecurityException, which is converted to this error. This is the object-level authorization gate layered on top of the query filter.

Source

Thrown at superset/daos/dashboard.py:201

        else:
            query = (
                db.session.query(Dashboard)
                .filter(id_or_slug_filter(id_or_slug))
                .outerjoin(Dashboard.editors)
            )
            # Apply dashboard base filters
            query = cls.base_filter("id", SQLAInterface(Dashboard, db.session)).apply(
                query, None
            )
            dashboard = query.one_or_none()
        if not dashboard:
            raise DashboardNotFoundError()

        # make sure we still have basic access check from security manager
        try:
            dashboard.raise_for_access()
        except SupersetSecurityException as ex:
            raise DashboardAccessDeniedError() from ex

        return dashboard

    @staticmethod
    def get_datasets_for_dashboard(id_or_slug: str) -> list[tuple[Any, dict[str, Any]]]:
        dashboard = DashboardDAO.get_by_id_or_slug(id_or_slug)
        return dashboard.datasets_trimmed_for_slices()

    @staticmethod
    def get_tabs_for_dashboard(id_or_slug: str) -> dict[str, Any]:
        dashboard = DashboardDAO.get_by_id_or_slug(id_or_slug)
        return dashboard.tabs

    @staticmethod
    def get_charts_for_dashboard(id_or_slug: str) -> list[Slice]:
        return DashboardDAO.get_by_id_or_slug(id_or_slug).slices

    @staticmethod

View on GitHub (pinned to f4587218dd)

Solutions

1. Grant access on the dashboard: add the user as owner, add their role under the dashboard's access list, or enable all-users access.
2. For embedded flows, include the dashboard in the guest token's RLS/resources claims.
3. Catch DashboardAccessDeniedError separately from DashboardNotFoundError so UI can show 403 vs 404 correctly.

Example fix

# before
try:
    dash = DashboardDAO.get_by_id_or_slug(slug)
except DashboardNotFoundError:
    abort(404)  # access denied also surfaces as generic failure

# after
try:
    dash = DashboardDAO.get_by_id_or_slug(slug)
except DashboardNotFoundError:
    abort(404)
except DashboardAccessDeniedError:
    abort(403)

def can_access_dashboard(user, dash) -> bool:
    try:
        dash.raise_for_access()
        return True
    except SupersetSecurityException:
        return False

from superset.daos.dashboard import DashboardDAO
from superset.errors import SupersetSecurityException

try:
    dash = DashboardDAO.get_by_id_or_slug(id_or_slug)
except DashboardAccessDeniedError:
    return redirect('/login')  # or 403 for API clients
except DashboardNotFoundError:
    abort(404)

When it happens

Trigger: Fetching a dashboard whose ownership/role/access settings exclude the current user (raise_for_access consults security manager rules — owner, roles with access, RLS-adjacent dashboard access), e.g. an embedded guest token lacking the dashboard, or a user whose role was revoked read.

Common situations: Embedded SDK sessions with guest tokens missing the dashboard in `resources`; role changes revoking dashboard access while UI caches keep the link alive; service accounts used for exports that were never granted access.

Related errors

• Changing this Dashboard is forbidden
• Cannot convert node type: ${node.type}
• Changing this Dashboard is forbidden
• Changing this Dashboard is forbidden
• User doesn't have permission to create or update datasets

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/58e21c3e4a56ec37. Report an issue: GitHub.