{"record":{"id":"44e4d04850b4f967","repo":"n8n-io/n8n","slug":"400-44e4d0","errorCode":"400","errorMessage":"You must enable two-factor authentication on your own account before enforcing it for all users","messagePattern":"You must enable two-factor authentication on your own account before enforcing it for all users","errorType":"exception","errorClass":"BadRequestError","httpStatus":400,"severity":"error","filePath":"packages/cli/src/controllers/mfa.controller.ts","lineNumber":44,"sourceCode":"\t\tprivate userRepository: UserRepository,\n\t\tprivate eventService: EventService,\n\t\tprivate instanceSettingsLoaderConfig: InstanceSettingsLoaderConfig,\n\t) {}\n\n\t@Post('/enforce-mfa')\n\t@GlobalScope('user:enforceMfa')\n\tasync enforceMFA(req: MFA.Enforce) {\n\t\tif (this.instanceSettingsLoaderConfig.securityPolicyManagedByEnv) {\n\t\t\tthrow new ForbiddenError(\n\t\t\t\t'MFA enforcement is managed via environment variables and cannot be modified through the API',\n\t\t\t);\n\t\t}\n\n\t\tif (req.body.enforce && !(req.authInfo?.usedMfa ?? false)) {\n\t\t\t// The current user tries to enforce MFA, but does not have\n\t\t\t// MFA set up for them self. We are forbidding this, to\n\t\t\t// help the user not lock them selfs out.\n\t\t\tthrow new BadRequestError(\n\t\t\t\t'You must enable two-factor authentication on your own account before enforcing it for all users',\n\t\t\t);\n\t\t}\n\t\tawait this.mfaService.enforceMFA(req.body.enforce);\n\n\t\tthis.eventService.emit('instance-policies-updated', {\n\t\t\tuser: {\n\t\t\t\tid: req.user.id,\n\t\t\t\temail: req.user.email,\n\t\t\t\tfirstName: req.user.firstName,\n\t\t\t\tlastName: req.user.lastName,\n\t\t\t\trole: req.user.role,\n\t\t\t},\n\t\t\tsettingName: '2fa_enforcement',\n\t\t\tvalue: req.body.enforce,\n\t\t});\n\n\t\treturn;","sourceCodeStart":26,"sourceCodeEnd":62,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/controllers/mfa.controller.ts#L26-L62","documentation":"An admin attempts to enforce MFA instance-wide (`enforce: true`) while their own session did not use MFA (`req.authInfo.usedMfa === false`). n8n refuses the call as a lock-out guard: an admin who cannot use MFA themselves should not force it on everyone.","triggerScenarios":"POST /rest/mfa/enforce-mfa with body.enforce=true and the caller's authInfo.usedMfa falsy (session did not pass MFA).","commonSituations":"Newly promoted admin who never enrolled a TOTP; admin logged in via a session that skipped MFA; trying to flip the policy from a non-MFA browser.","solutions":["Enable MFA on your own account first: GET /rest/mfa/qr then POST /rest/mfa/enable, and re-authenticate with the code.","Re-issue the request from an MFA-authenticated session (usedMfa=true)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Require the caller's own session to have used MFA before allowing enforce=true.\nif (enforce && !authInfo.usedMfa) {\n  throw new Error('Enable MFA on your own account first, then retry enforce.');\n}\nawait restApi.post('/mfa/enforce-mfa', { enforce });","typeGuard":"function sessionUsedMfa(a: { usedMfa?: boolean }): boolean {\n  return a?.usedMfa === true;\n}","tryCatchPattern":null,"preventionTips":["Surface a pre-checklist: 'Enable MFA on your account → re-login with MFA → then enforce'.","Refresh authInfo (e.g. from the login response) before showing the enforce control.","Hide the enforce toggle until usedMfa is true."],"tags":["mfa","admin","safety","authorization"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}