{"record":{"id":"18848ac837f6ca69","repo":"bitwarden/server","slug":"not-authorized","errorCode":null,"errorMessage":"Not authorized.","messagePattern":"Not authorized\\.","errorType":"exception","errorClass":"UnauthorizedAccessException","httpStatus":401,"severity":"error","filePath":"src/Admin/Utilities/RequirePermissionAttribute.cs","lineNumber":23,"sourceCode":"namespace Bit.Admin.Utilities;\n\npublic class RequirePermissionAttribute : ActionFilterAttribute\n{\n    public Permission Permission { get; set; }\n\n    public RequirePermissionAttribute(Permission permission)\n    {\n        Permission = permission;\n    }\n\n    public override void OnActionExecuting(ActionExecutingContext context)\n    {\n        var accessControlService = context.HttpContext.RequestServices.GetRequiredService<IAccessControlService>();\n\n        var hasPermission = accessControlService.UserHasPermission(Permission);\n        if (!hasPermission)\n        {\n            throw new UnauthorizedAccessException(\"Not authorized.\");\n        }\n    }\n}\n","sourceCodeStart":5,"sourceCodeEnd":27,"githubUrl":"https://github.com/bitwarden/server/blob/e93b962371d80964556f5590c6615f5160a437a1/src/Admin/Utilities/RequirePermissionAttribute.cs#L5-L27","documentation":"An UnauthorizedAccessException (HTTP 401/403) thrown by RequirePermissionAttribute.OnActionExecuting when the authenticated admin user does not have the required Permission flag as determined by IAccessControlService.UserHasPermission. This is the admin panel's authorization gate for every action decorated with [RequirePermission].","triggerScenarios":"Any admin panel action decorated with [RequirePermission(X)] is invoked by a user whose role does not grant permission X. The attribute runs as an MVC action filter before the controller method executes.","commonSituations":"A read-only admin role attempts a write action. A newly created admin account hasn't been granted the necessary permissions. Permission definitions were changed (enum updated) without migrating role assignments. A developer tests locally without proper admin role configuration.","solutions":["Verify the user's admin role includes the required Permission flag (check the role configuration in the admin portal or database).","If using the access control service with a permissions JSON/config, ensure the config grants the needed permission to the user's role.","For local development, confirm the admin user seed/configuration assigns the expected permissions.","If permissions were recently changed, have the user log out and back in to refresh their permission claims."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// Global admin exception filter\ncatch (UnauthorizedAccessException)\n{ return View(\"AccessDenied\"); }","preventionTips":["Assign admin roles with only the permissions each role needs (least privilege).","Document which permissions each admin panel section requires.","Test new admin accounts against the actions they need to use before going live.","After permission enum changes, audit and migrate all stored role assignments."],"tags":["admin","authorization","permissions","security","http-401"],"backgroundTag":null,"analyzedSha":"e93b962371d80964556f5590c6615f5160a437a1","analyzedAt":"2026-08-13T14:22:19.382Z","schemaVersion":2},"datasetVersion":"2026-08-13T19:17:28.613Z"}