apache/superset · error · TemporaryCacheAccessDeniedError

You don't have permission to modify the value.

Error message

You don't have permission to modify the value.

What it means

Error "You don't have permission to modify the value." thrown in apache/superset.

Source

Thrown at superset/commands/explore/form_data/update.py:63

    ):
        self._cmd_params = cmd_params

    def run(self) -> Optional[str]:
        self.validate()
        try:
            datasource_id = self._cmd_params.datasource_id
            chart_id = self._cmd_params.chart_id
            datasource_type = self._cmd_params.datasource_type
            key = self._cmd_params.key
            form_data = self._cmd_params.form_data
            check_access(datasource_id, chart_id, datasource_type)
            state: TemporaryExploreState = cache_manager.explore_form_data_cache.get(
                key
            )
            owner = get_user_id()
            if state and form_data:
                if state["owner"] != owner:
                    raise TemporaryCacheAccessDeniedError()

                # Generate a new key if tab_id changes or equals 0
                tab_id = self._cmd_params.tab_id
                contextual_key = cache_key(
                    session.get("_id"), tab_id, datasource_id, chart_id, datasource_type
                )
                key = cache_manager.explore_form_data_cache.get(contextual_key)
                if not key or not tab_id:
                    key = random_key()
                    cache_manager.explore_form_data_cache.set(contextual_key, key)

                new_state: TemporaryExploreState = {
                    "owner": owner,
                    "datasource_id": datasource_id,
                    "datasource_type": DatasourceType(datasource_type),
                    "chart_id": chart_id,
                    "form_data": form_data,
                }

View on GitHub (pinned to f4587218dd)

Solutions

1. Verify the current user owns the form_data key or has the ExploreFormDataRestApi permission to modify it.
2. Create a new form_data key with POST /api/v1/explore/form_data instead of updating one owned by another user.

When it happens

Trigger: PUT /api/v1/explore/form_data/<key> is called by a user who is not the owner of the stored form_data payload.

Common situations: Updating Explore form_data key-value state via the API; the current user lacks ownership/admin rights over the stored value.

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/eaa31b63218e2e95. Report an issue: GitHub.