{"record":{"id":"3f8f922e75234bb6","repo":"goharbor/harbor","slug":"denied-3f8f92","errorCode":"DENIED","errorMessage":"permission scope is invalid. It must be equal to or more restrictive than the creator robot's permissions: %s","messagePattern":"permission scope is invalid\\. It must be equal to or more restrictive than the creator robot's permissions: (.+?)","errorType":"http","errorClass":"errors.Error","httpStatus":403,"severity":"error","filePath":"src/server/v2.0/handler/robot.go","lineNumber":92,"sourceCode":"\tcase *robotSc.SecurityContext:\n\t\tif s.User() == nil {\n\t\t\treturn rAPI.SendError(ctx, errors.New(nil).WithMessage(\"invalid security context: empty robot account\"))\n\t\t}\n\t\tif !isValidPermissionScope(params.Robot.Permissions, s.User().Permissions) {\n\t\t\treturn rAPI.SendError(ctx, errors.BadRequestError(errors.New(\"permission scope is invalid. It must be equal to or more restrictive than the creator robot's permissions\")))\n\t\t}","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/goharbor/harbor/blob/7b2fd08cc568955cca339afeefab27372840d936/src/server/v2.0/handler/robot.go#L74-L110","documentation":"Privilege-escalation guard in CreateRobot: when a robot account creates another robot, isValidPermissionScope checks the new robot's permissions are equal or narrower than the creator's. It fires (naming the creator's scope) when the request attempts to grant the new robot more/broader permissions than the creating robot holds.","triggerScenarios":"Thrown at src/server/v2.0/handler/robot.go:92 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Reduce the new robot's requested permissions to a subset of the creator robot's","Create the robot with a user/system admin account instead of a robot account","Set the access scope (project) to the same or narrower namespace"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"7b2fd08cc568955cca339afeefab27372840d936","analyzedAt":"2026-08-16T00:00:10.961Z","contentChangedAt":"2026-08-16T00:00:10.961Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}