{"record":{"id":"5b0c2606a93893b3","repo":"passbolt/passbolt_api","slug":"you-are-not-authorized-to-access-that-location-5b0c26","errorCode":null,"errorMessage":"You are not authorized to access that location.","messagePattern":"You are not authorized to access that location\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\ForbiddenException","httpStatus":403,"severity":"error","filePath":"src/Controller/Users/UsersEditController.php","lineNumber":151,"sourceCode":"\n        $this->sendAfterUpdateEvent($userEntityWithDirtyState);\n\n        $this->success(__('The user has been updated successfully.'), $user);\n    }\n\n    /**\n     * Validate if the user is authorized to edit the data\n     *\n     * @param array $data user data\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException if the user is not admin or not editing themselves\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException if the user is not admin and editing role\n     */\n    protected function assertCanEdit(array $data): void\n    {\n        // Admin can edit all users, other users can only edit themselves\n        if ($this->User->role() !== Role::ADMIN && $data['id'] !== $this->User->id()) {\n            throw new ForbiddenException(__('You are not authorized to access that location.'));\n        }\n        if ($this->User->role() !== Role::ADMIN && (isset($data['role']) || isset($data['role_id']))) {\n            throw new ForbiddenException(__('You are not authorized to edit the role.'));\n        }\n    }\n\n    /**\n     * Validate the data coming from the request\n     *\n     * @param array $data user data\n     * @return void\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if gpgkey is sent (v2 only)\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if groups data is sent (v2 only)\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if data is not provided or invalid\n     */\n    protected function assertRequestData(array $data): void\n    {\n        if (empty($data) || count($data) < 2) {","sourceCodeStart":133,"sourceCodeEnd":169,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Controller/Users/UsersEditController.php#L133-L169","documentation":"ForbiddenException (HTTP 403) from assertCanEdit in UsersEditController: a non-admin authenticated user attempted to edit a user other than themselves. The controller enforces that admins can edit all users while regular users may only edit their own record.","triggerScenarios":"PUT /users/{id}.json where the authenticated user's role is not admin and the payload's `id` differs from the logged-in user's id.","commonSituations":"A client library configured with one user's credentials used to update another user's profile; automated scripts iterating over user ids with a non-admin account; id mismatch after copying payloads between requests.","solutions":["Use credentials of a user whose id matches the target record, or authenticate as an admin.","Ensure the `id` in the request body equals the authenticated user's id for self-service edits.","Check which account the API client is configured for (wrong passphrase/keys or shared config can silently use the wrong user)."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"function assertSelfEdit(session, targetId) { if (session.role !== 'admin' && session.userId !== targetId) { throw new Error('Refusing edit: non-admin cannot edit another user'); } }","typeGuard":null,"tryCatchPattern":"try { await api.editUser(id, data); } catch (e) { if (e.code === 403) { switchToAdminSession(); } else { throw e; } }","preventionTips":["Confirm which account the API client is authenticated as before user operations.","Only use admin credentials for cross-user edits.","Never reuse a payload's id copied from another request."],"tags":["authorization","forbidden","http-403","users"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}