{"record":{"id":"2cae0fc8161c1df6","repo":"getredash/redash","slug":"incorrect-current-password","errorCode":null,"errorMessage":"Incorrect current password.","messagePattern":"Incorrect current password\\.","errorType":"http","errorClass":null,"httpStatus":403,"severity":"error","filePath":"redash/handlers/users.py","lineNumber":218,"sourceCode":"        user = get_object_or_404(models.User.get_by_id_and_org, user_id, self.current_org)\n\n        self.record_event({\"action\": \"view\", \"object_id\": user_id, \"object_type\": \"user\"})\n\n        return user.to_dict(with_api_key=is_admin_or_owner(user_id))\n\n    def post(self, user_id):  # noqa: C901\n        require_admin_or_owner(user_id)\n        user = models.User.get_by_id_and_org(user_id, self.current_org)\n\n        req = request.get_json(True)\n\n        params = project(req, (\"email\", \"name\", \"password\", \"old_password\", \"group_ids\"))\n\n        if \"password\" in params and \"old_password\" not in params:\n            abort(403, message=\"Must provide current password to update password.\")\n\n        if \"old_password\" in params and not user.verify_password(params[\"old_password\"]):\n            abort(403, message=\"Incorrect current password.\")\n\n        if \"password\" in params:\n            user.hash_password(params.pop(\"password\"))\n            params.pop(\"old_password\")\n\n        if \"group_ids\" in params:\n            if not self.current_user.has_permission(\"admin\"):\n                abort(403, message=\"Must be admin to change groups membership.\")\n\n            for group_id in params[\"group_ids\"]:\n                try:\n                    models.Group.get_by_id_and_org(group_id, self.current_org)\n                except NoResultFound:\n                    abort(400, message=\"Group id {} is invalid.\".format(group_id))\n\n            if len(params[\"group_ids\"]) == 0:\n                params.pop(\"group_ids\")\n","sourceCodeStart":200,"sourceCodeEnd":236,"githubUrl":"https://github.com/getredash/redash/blob/ca79fe988d81cdac9675b412f3dfcab107bc1fbc/redash/handlers/users.py#L200-L236","documentation":"Raised by the user-update route in redash/handlers/users.py when old_password is provided but user.verify_password(old_password) fails — the submitted current password does not match the stored hash. The update is rejected with 403 before any change is applied.","triggerScenarios":"POST/PATCH updating the user with an incorrect old_password value (typo, outdated password, or password already changed elsewhere).","commonSituations":"Users typing an old password after a recent change; browser autofill submitting a stale password; automation holding a cached password that was rotated.","solutions":["Correct the old_password value to the user's actual current password.","If forgotten, use the password-reset email flow (or admin reset) instead of the update endpoint.","Keep credential sources in sync after any rotation; never cache passwords long-term."],"exampleFix":"# before\nclient.post(f'/api/users/{uid}', json={'password': 'newsecret', 'old_password': 'wrong'})\n\n# after\nclient.post(f'/api/users/{uid}', json={'password': 'newsecret', 'old_password': 'correct_current'})","handlingStrategy":"validation","validationCode":"if not user.verify_password(old_password):\n    raise ValueError('current password mismatch — use reset flow')","typeGuard":null,"tryCatchPattern":"try:\n    client.post(f'/api/users/{uid}', json=payload)\nexcept HTTPError as e:\n    if e.response.status_code == 403 and 'Incorrect current password' in e.response.text:\n        send_password_reset(user.email)\n    else:\n        raise","preventionTips":["Disable browser autofill on the old-password field to avoid stale values.","After any rotation, update stored credentials immediately; use reset flow on mismatch."],"tags":["redash","users","password","forbidden","authentication"],"backgroundTag":"incorrect-current-password","analyzedSha":"ca79fe988d81cdac9675b412f3dfcab107bc1fbc","analyzedAt":"2026-08-28T18:32:34.637Z","schemaVersion":2},"datasetVersion":"2026-08-28T21:17:43.275Z"}