{"record":{"id":"58e21c3e4a56ec37","repo":"apache/superset","slug":"you-don-t-have-access-to-this-dashboard","errorCode":null,"errorMessage":"You don't have access to this dashboard.","messagePattern":"You don't have access to this dashboard\\.","errorType":"http","errorClass":"DashboardAccessDeniedError","httpStatus":403,"severity":"error","filePath":"superset/daos/dashboard.py","lineNumber":201,"sourceCode":"        else:\n            query = (\n                db.session.query(Dashboard)\n                .filter(id_or_slug_filter(id_or_slug))\n                .outerjoin(Dashboard.editors)\n            )\n            # Apply dashboard base filters\n            query = cls.base_filter(\"id\", SQLAInterface(Dashboard, db.session)).apply(\n                query, None\n            )\n            dashboard = query.one_or_none()\n        if not dashboard:\n            raise DashboardNotFoundError()\n\n        # make sure we still have basic access check from security manager\n        try:\n            dashboard.raise_for_access()\n        except SupersetSecurityException as ex:\n            raise DashboardAccessDeniedError() from ex\n\n        return dashboard\n\n    @staticmethod\n    def get_datasets_for_dashboard(id_or_slug: str) -> list[tuple[Any, dict[str, Any]]]:\n        dashboard = DashboardDAO.get_by_id_or_slug(id_or_slug)\n        return dashboard.datasets_trimmed_for_slices()\n\n    @staticmethod\n    def get_tabs_for_dashboard(id_or_slug: str) -> dict[str, Any]:\n        dashboard = DashboardDAO.get_by_id_or_slug(id_or_slug)\n        return dashboard.tabs\n\n    @staticmethod\n    def get_charts_for_dashboard(id_or_slug: str) -> list[Slice]:\n        return DashboardDAO.get_by_id_or_slug(id_or_slug).slices\n\n    @staticmethod","sourceCodeStart":183,"sourceCodeEnd":219,"githubUrl":"https://github.com/apache/superset/blob/f4587218dd19d046c3e4d00063e7d27f8a2ed354/superset/daos/dashboard.py#L183-L219","documentation":"DashboardAccessDeniedError ('You don't have access to this dashboard.') raised by DashboardDAO.get_by_id_or_slug: the row was found and passed the base filter, but the explicit security_manager-level check dashboard.raise_for_access() raised SupersetSecurityException, which is converted to this error. This is the object-level authorization gate layered on top of the query filter.","triggerScenarios":"Fetching a dashboard whose ownership/role/access settings exclude the current user (raise_for_access consults security manager rules — owner, roles with access, RLS-adjacent dashboard access), e.g. an embedded guest token lacking the dashboard, or a user whose role was revoked read.","commonSituations":"Embedded SDK sessions with guest tokens missing the dashboard in `resources`; role changes revoking dashboard access while UI caches keep the link alive; service accounts used for exports that were never granted access.","solutions":["Grant access on the dashboard: add the user as owner, add their role under the dashboard's access list, or enable all-users access.","For embedded flows, include the dashboard in the guest token's RLS/resources claims.","Catch DashboardAccessDeniedError separately from DashboardNotFoundError so UI can show 403 vs 404 correctly."],"exampleFix":"# before\ntry:\n    dash = DashboardDAO.get_by_id_or_slug(slug)\nexcept DashboardNotFoundError:\n    abort(404)  # access denied also surfaces as generic failure\n\n# after\ntry:\n    dash = DashboardDAO.get_by_id_or_slug(slug)\nexcept DashboardNotFoundError:\n    abort(404)\nexcept DashboardAccessDeniedError:\n    abort(403)","handlingStrategy":"try-catch","validationCode":"def can_access_dashboard(user, dash) -> bool:\n    try:\n        dash.raise_for_access()\n        return True\n    except SupersetSecurityException:\n        return False","typeGuard":"from superset.daos.dashboard import DashboardDAO\nfrom superset.errors import SupersetSecurityException","tryCatchPattern":"try:\n    dash = DashboardDAO.get_by_id_or_slug(id_or_slug)\nexcept DashboardAccessDeniedError:\n    return redirect('/login')  # or 403 for API clients\nexcept DashboardNotFoundError:\n    abort(404)","preventionTips":["Catch DashboardAccessDeniedError separately from DashboardNotFoundError; they need different responses.","For embedded SDK, include the dashboard in the guest token's resources.","When granting a role dashboard access, verify by fetching as that role's user."],"tags":["security","dashboard","permissions","authorization","rbac"],"backgroundTag":null,"analyzedSha":"f4587218dd19d046c3e4d00063e7d27f8a2ed354","analyzedAt":"2026-08-14T22:39:27.425Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}