{"record":{"id":"51087744826a6635","repo":"apache/superset","slug":"you-don-t-have-permission-to-modify-the-value-510877","errorCode":null,"errorMessage":"You don't have permission to modify the value.","messagePattern":"You don't have permission to modify the value\\.","errorType":"exception","errorClass":"TemporaryCacheAccessDeniedError","httpStatus":403,"severity":"error","filePath":"superset/commands/explore/form_data/delete.py","lineNumber":55,"sourceCode":"\n\nclass DeleteFormDataCommand(BaseCommand, ABC):\n    def __init__(self, cmd_params: CommandParameters):\n        self._cmd_params = cmd_params\n\n    def run(self) -> bool:\n        try:\n            key = self._cmd_params.key\n            state: TemporaryExploreState = cache_manager.explore_form_data_cache.get(\n                key\n            )\n            if state:\n                datasource_id: int = state[\"datasource_id\"]\n                chart_id: Optional[int] = state[\"chart_id\"]\n                datasource_type = DatasourceType(state[\"datasource_type\"])\n                check_access(datasource_id, chart_id, datasource_type)\n                if state[\"owner\"] != get_user_id():\n                    raise TemporaryCacheAccessDeniedError()\n                tab_id = self._cmd_params.tab_id\n                contextual_key = cache_key(\n                    session.get(\"_id\"), tab_id, datasource_id, chart_id, datasource_type\n                )\n                cache_manager.explore_form_data_cache.delete(contextual_key)\n                return cache_manager.explore_form_data_cache.delete(key)\n            return False\n        except SQLAlchemyError as ex:\n            logger.exception(\"Error running delete command\")\n            raise TemporaryCacheDeleteFailedError() from ex\n\n    def validate(self) -> None:\n        pass\n","sourceCodeStart":37,"sourceCodeEnd":69,"githubUrl":"https://github.com/apache/superset/blob/f4587218dd19d046c3e4d00063e7d27f8a2ed354/superset/commands/explore/form_data/delete.py#L37-L69","documentation":"TemporaryCacheAccessDeniedError is raised by the explore form_data delete command when the cached state's 'owner' (user id recorded at creation) differs from the current get_user_id(). Access to the datasource was already checked via check_access; this second gate ensures only the creator may delete their temporary explore state.","triggerScenarios":"DELETE of an explore form_data cache key that was created by a different user — e.g. sharing an Explore link and the recipient's client issues a delete for the original key, or a user re-authenticates as a different account in the same browser session.","commonSituations":"Shared Explore URLs whose embedded key was minted by a colleague. Session/user switching in the same browser. Automation replaying captured delete calls with different credentials.","solutions":["Only delete keys your own session created; if you received a shared link, copy the form data into your own state instead of deleting the original.","Re-authenticate as the original owner if you legitimately must remove the entry.","An admin can drop stale entries directly from the cache backend if cleanup is required."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"state = cache_manager.explore_form_data_cache.get(key)\nif state and state[\"owner\"] != get_user_id():\n    respond(403, \"you did not create this explore state\")","typeGuard":null,"tryCatchPattern":"try:\n    DeleteTemporaryExploreStateCommand(...).run()\nexcept TemporaryCacheAccessDeniedError:\n    # copy the form data into your own state instead of deleting the original","preventionTips":["Don't replay captured delete calls across user sessions.","When sharing explore links, fork the state rather than mutating the owner's key.","Clear cookies/re-login fully when switching accounts."],"tags":["explore","cache","permissions","ownership"],"backgroundTag":null,"analyzedSha":"f4587218dd19d046c3e4d00063e7d27f8a2ed354","analyzedAt":"2026-08-14T22:39:27.425Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}