{"record":{"id":"2ef317b72eb91b41","repo":"n8n-io/n8n","slug":"400","errorCode":"400","errorMessage":"Current password is required to change email","messagePattern":"Current password is required to change email","errorType":"exception","errorClass":"BadRequestError","httpStatus":400,"severity":"warning","filePath":"packages/cli/src/controllers/me.controller.ts","lineNumber":159,"sourceCode":"\t\t\tif (!payload.mfaCode) {\n\t\t\t\tthrow new BadRequestError('Two-factor code is required to change email');\n\t\t\t}\n\n\t\t\tconst isMfaCodeValid = await this.mfaService.validateMfa(userId, payload.mfaCode, undefined);\n\t\t\tif (!isMfaCodeValid) {\n\t\t\t\tthrow new InvalidMfaCodeError();\n\t\t\t}\n\t\t} else {\n\t\t\tif (currentUser.password === null) {\n\t\t\t\tthis.logger.debug('User with no password changed their email', {\n\t\t\t\t\tuserId: currentUser.id,\n\t\t\t\t\tpayload: payloadWithoutPassword,\n\t\t\t\t});\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tif (!providedCurrentPassword || typeof providedCurrentPassword !== 'string') {\n\t\t\t\tthrow new BadRequestError('Current password is required to change email');\n\t\t\t}\n\n\t\t\tconst isProvidedPasswordCorrect = await this.passwordUtility.compare(\n\t\t\t\tprovidedCurrentPassword,\n\t\t\t\tcurrentUser.password,\n\t\t\t);\n\t\t\tif (!isProvidedPasswordCorrect) {\n\t\t\t\tthrow new BadRequestError(\n\t\t\t\t\t'Unable to update profile. Please check your credentials and try again.',\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate isUserManagedByEnv(user: User): boolean {\n\t\tconst { instanceSettingsLoader } = this.globalConfig;\n\t\treturn (\n\t\t\tinstanceSettingsLoader.ownerManagedByEnv &&","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/controllers/me.controller.ts#L141-L177","documentation":"A BadRequestError (HTTP 400) from validateChangingUserEmail when the user is MFA-disabled (mfaEnabled false), has a password set, but providedCurrentPassword is missing or not a string. To change email without 2FA, the user must re-confirm with their current password; omitting it is rejected.","triggerScenarios":"PATCH /me changing email for a password-based (non-MFA) user where currentPassword is omitted, null, undefined, or a non-string type. The branch is reached because mfaEnabled is false and currentUser.password is non-null.","commonSituations":"Frontend form omits the current-password field for email change; client serializes the field as null; user leaves the field blank; a script that only sends the new email.","solutions":["Include a non-empty currentPassword string in the PATCH /me body when changing email without MFA.","Add a 'current password' input to the email-change form for non-MFA users.","Validate typeof currentPassword === 'string' && currentPassword on the client before submit."],"exampleFix":"// before\nawait api.patch('/me', { email: newEmail });\n\n// after\nawait api.patch('/me', { email: newEmail, currentPassword: promptPassword() });","handlingStrategy":"validation","validationCode":"// Require current password for email change when MFA is off.\nif (!me.mfaEnabled && isEmailChange(payload, me.email)) {\n  if (typeof payload.currentPassword !== 'string' || payload.currentPassword.length === 0) {\n    throw new Error('Current password is required to change email');\n  }\n}","typeGuard":"function hasCurrentPassword(p: { currentPassword?: string }): p is { currentPassword: string } {\n  return typeof p.currentPassword === 'string' && p.currentPassword.length > 0;\n}","tryCatchPattern":"try {\n  await api.patch('/me', { ...payload, currentPassword });\n} catch (e) {\n  if (e.response?.status === 400 && /current password is required/i.test(e.response.data.message)) {\n    currentPassword = await promptPassword();\n    await api.patch('/me', { ...payload, currentPassword });\n    return;\n  }\n  throw e;\n}","preventionTips":["Add a current-password field to the email-change form for non-MFA users.","Validate currentPassword is a non-empty string before submit.","Do not send null/undefined for required credential fields."],"tags":["me","email","password","validation","rest-api"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}