{"record":{"id":"01983e83df1c534b","repo":"payloadcms/payload","slug":"you-are-not-allowed-to-perform-this-action-01983e","errorCode":null,"errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"http","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/payload/src/collections/operations/updateByID.ts","lineNumber":174,"sourceCode":"      req,\n      where: fullWhere,\n    }\n\n    const docWithLocales = await getLatestCollectionVersion<\n      RequiredDataFromCollectionSlug<TSlug> & TypeWithID\n    >({\n      id,\n      config: collectionConfig,\n      payload,\n      query: findOneArgs,\n      req,\n    })\n\n    if (!docWithLocales && !hasWherePolicy) {\n      throw new NotFound(req.t)\n    }\n    if (!docWithLocales && hasWherePolicy) {\n      throw new Forbidden(req.t)\n    }\n    if (!docWithLocales) {\n      throw new NotFound(req.t)\n    }\n\n    // /////////////////////////////////////\n    // Generate data for all files and sizes\n    // /////////////////////////////////////\n\n    const { data: newFileData, files: filesToUpload } = await generateFileData({\n      collection,\n      config,\n      data,\n      operation: 'update',\n      overwriteExistingFiles,\n      req,\n      throwOnMissingFile: false,\n    })","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/collections/operations/updateByID.ts#L156-L192","documentation":"Thrown during updateByID when no document is found BUT the collection's update access resolved to a where-policy. Payload cannot tell whether the document does not exist or merely is access-restricted, so it returns HTTP 403 Forbidden to avoid leaking existence. This is the standard access-control information-leak prevention pattern.","triggerScenarios":"A user whose `access.update` returns a `{ where: {...} }` constraint tries to update a document they cannot see; updating an id that belongs to another tenant; the document exists but falls outside the where-clause scope.","commonSituations":"Multi-tenant setups where `update` access is scoped by `tenant`/`user`; a logged-in user editing another user's content; role-based access returning a restrictive where clause.","solutions":["Ensure the calling user actually has update access to that document (check the access predicate locally first).","Return a clear 'not allowed' message to the end user; do not retry with different ids.","If the behavior is wrong, audit the collection's `access.update` function — it may be over-restrictive."],"exampleFix":"// before\nawait payload.update({ collection: 'posts', id, data, req, overrideAccess: false })\n// after\n// Verify ownership first using a read-scoped query\nconst doc = await payload.findByID({ collection: 'posts', id, req })\nif (!doc) throw new ForbiddenError('cannot update this post')\nawait payload.update({ collection: 'posts', id, data, req })","handlingStrategy":"try-catch","validationCode":"// Enforce access locally before update by attempting a scoped read\nconst doc = await payload.findByID({ collection, id, req, depth: 0 }).catch(() => null)\nif (!doc) {\n  throw new ForbiddenError('User cannot update this document')\n}\nawait payload.update({ collection, id, data, req })","typeGuard":null,"tryCatchPattern":"try {\n  await payload.update({ collection, id, data, req })\n} catch (err) {\n  if (err instanceof Forbidden) {\n    // access-restricted (or does not exist) — do not leak which\n    return respond(403, 'Not allowed')\n  }\n  throw err\n}","preventionTips":["Audit `collectionConfig.access.update` so the where-scope matches intent.","Pre-check with a scoped read to fail fast with a clear message.","Never distinguish 'missing' vs 'forbidden' to the end user — return the same 403."],"tags":["access-control","update","forbidden","multi-tenant","security"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}