{"record":{"id":"36ab2eee63c7cf20","repo":"passbolt/passbolt_api","slug":"you-are-not-allowed-to-update-the-permissions-of-this-folder","errorCode":null,"errorMessage":"You are not allowed to update the permissions of this folder.","messagePattern":"You are not allowed to update the permissions of this folder\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltCe/Folders/src/Service/Folders/FoldersShareService.php","lineNumber":174,"sourceCode":"\n        return $folder;\n    }\n\n    /**\n     * Assert if the operator can share the given folder.\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac The operator\n     * @param \\Passbolt\\Folders\\Model\\Entity\\Folder $folder The folder to assert\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException If the user cannot share the folder\n     */\n    private function assertUserCanShare(UserAccessControl $uac, Folder $folder): void\n    {\n        $userId = $uac->getId();\n        $isAllowed = $this->userHasPermissionService\n            ->check(PermissionsTable::FOLDER_ACO, $folder->id, $userId, Permission::OWNER);\n        if (!$isAllowed) {\n            throw new ForbiddenException(__('You are not allowed to update the permissions of this folder.'));\n        }\n    }\n\n    /**\n     * Update a folder permissions\n     *\n     * @param \\App\\Utility\\UserAccessControl $uac The operator\n     * @param \\Passbolt\\Folders\\Model\\Entity\\Folder $folder The target folder\n     * @param array $changes The list of permissions changes\n     * @return \\App\\Model\\Dto\\EntitiesChangesDto\n     * @throws \\App\\Error\\Exception\\ValidationException If the permissions didn't validate\n     * @throws \\Exception If something went wrong\n     */\n    private function updatePermissions(UserAccessControl $uac, Folder $folder, array $changes): EntitiesChangesDto\n    {\n        $entitiesChanges = new EntitiesChangesDto();\n\n        try {","sourceCodeStart":156,"sourceCodeEnd":192,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/Folders/src/Service/Folders/FoldersShareService.php#L156-L192","documentation":"A ForbiddenException thrown by FoldersShareService::assertUserCanShare when a user attempts to share a folder (update its permissions) without being the folder's OWNER. The service checks the user's highest permission on the folder via UserHasPermissionService and requires exactly Permission::OWNER. Only owners may modify folder permissions, so any lesser permission (UPDATE or READ) results in this error.","triggerScenarios":"POST /folders/{folderId}/share (FoldersShareService::share) called by a user whose highest permission on the folder is UPDATE or READ, or who has no permission at all; also when sharing a folder the user can access only through inherited/group permissions but does not personally own.","commonSituations":"A folder owner shares a folder with a collaborator as EDITOR; the collaborator tries to re-share the folder or change permissions of nested content and gets a 403. Also seen in automated scripts using an API key/account that only has update rights, and after ownership was transferred away from the acting user.","solutions":["Log in or act as a user who is OWNER of the folder, or have the current owner perform the share operation.","Transfer ownership: as an owner, share the folder with the desired user with permission type OWNER, then retry the share as that user.","Verify the user's effective permission with the permission checks (e.g. GET /folders/{id} or permissions endpoints) before calling share.","If ownership data is wrong (e.g. the original owner left), an administrator can fix the permissions rows in the database or via the health check data repair tools."],"exampleFix":"// before: share as a mere editor\nPOST /folders/{id}/share with uac of a non-owner user -> 403\n// after: promote user to owner first (as existing owner)\nPOST /folders/{id}/share {\"permissions\":[{\"aro\":{\"id\":\"<userId>\"},\"type\":50}]} // 50 = OWNER\n// then perform the share as that user","handlingStrategy":"try-catch","validationCode":"// Before sharing, check ownership client-side\nconst perms = await api.get(`/permissions/folder/${folderId}`);\nconst mine = perms.find(p => p.user.id === currentUserId);\nif (!mine || mine.type !== 15) {\n  throw new Error('Only the folder OWNER can share this folder');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await foldersApi.share(folderId, permissions);\n} catch (e) {\n  if (e.response?.status === 403) {\n    // user is not OWNER: request ownership or delegate to owner\n  }\n  throw e;\n}","preventionTips":["Only call the share endpoint as the folder's owner (permission type 15).","Check the user's permission type before attempting share operations.","In UIs, disable share controls for non-owner users.","Transfer ownership explicitly when the owner role must change hands."],"tags":["folder-permissions","authorization","forbidden","sharing"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}