{"record":{"id":"7396590d9f1b89bb","repo":"n8n-io/n8n","slug":"cannot-change-your-own-global-role","errorCode":null,"errorMessage":"Cannot change your own global role","messagePattern":"Cannot change your own global role","errorType":"exception","errorClass":"ForbiddenError","httpStatus":403,"severity":"error","filePath":"packages/cli/src/controllers/users.controller.ts","lineNumber":357,"sourceCode":"\t@GlobalScope('user:changeRole')\n\t@Licensed('feat:advancedPermissions')\n\tasync changeGlobalRole(\n\t\treq: AuthenticatedRequest,\n\t\t_: Response,\n\t\t@Body payload: RoleChangeRequestDto,\n\t\t@Param('id') id: string,\n\t) {\n\t\tif (await this.provisioningService.isInstanceRoleManaged()) {\n\t\t\tthrow new ForbiddenError(\n\t\t\t\t'Instance roles are managed automatically and cannot be changed manually',\n\t\t\t);\n\t\t}\n\n\t\tconst { NO_ADMIN_ON_OWNER, NO_USER, NO_OWNER_ON_OWNER, CANNOT_CHANGE_OWN_ROLE } =\n\t\t\tUsersController.ERROR_MESSAGES.CHANGE_ROLE;\n\n\t\tif (req.user.id === id) {\n\t\t\tthrow new ForbiddenError(CANNOT_CHANGE_OWN_ROLE);\n\t\t}\n\n\t\tconst targetUser = await this.userRepository.findOne({\n\t\t\twhere: { id },\n\t\t\trelations: ['role'],\n\t\t});\n\t\tif (targetUser === null) {\n\t\t\tthrow new NotFoundError(NO_USER);\n\t\t}\n\n\t\tif (\n\t\t\treq.user.role.slug === GLOBAL_ADMIN_ROLE.slug &&\n\t\t\ttargetUser.role.slug === GLOBAL_OWNER_ROLE.slug\n\t\t) {\n\t\t\tthrow new ForbiddenError(NO_ADMIN_ON_OWNER);\n\t\t}\n\n\t\tif (","sourceCodeStart":339,"sourceCodeEnd":375,"githubUrl":"https://github.com/n8n-io/n8n/blob/5ac6606e81f67bb9534255570cd4e86fd8101eee/packages/cli/src/controllers/users.controller.ts#L339-L375","documentation":"Returned by PATCH /users/:id/role when req.user.id === id — the caller is attempting to change their own global role. This is a privilege-escalation guard; the message is the CANNOT_CHANGE_OWN_ROLE constant from UsersController.ERROR_MESSAGES.CHANGE_ROLE. HTTP 403. Fires after the provisioning check, before target-user lookup.","triggerScenarios":"A user calling PATCH /users/<their-own-id>/role with a RoleChangeRequestDto to elevate or change their own role.","commonSituations":"Admin testing the endpoint on themselves; UI accidentally letting the current user pick themselves in the role-change dialog; automated role-sync job that includes the operator.","solutions":["Have a different authorized user (or the provisioning system) change the role.","Exclude the caller's id from any role-batch operation.","Hide the role-change affordance on the current user's own row in the UI."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"function assertNotSelf(targetId: string, currentUserId: string) {\n  if (targetId === currentUserId) {\n    throw new Error('Cannot change your own role; ask another authorized user');\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Exclude the caller's own id from role-change targets.","Hide the role-change affordance on the current user's row.","Use a peer or higher to change your role."],"tags":["users","rbac","role-change","self-protection","forbidden","authorization"],"backgroundTag":null,"analyzedSha":"5ac6606e81f67bb9534255570cd4e86fd8101eee","analyzedAt":"2026-08-12T05:26:35.080Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}