{"record":{"id":"759d2777c22ecc84","repo":"hashicorp/vault","slug":"you-do-not-have-permissions-to-update-your-passwor","errorCode":null,"errorMessage":"You do not have permissions to update your password. If you think this is a mistake ask your administrator to update your policy.","messagePattern":"You do not have permissions to update your password\\. If you think this is a mistake ask your administrator to update your policy\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"ui/app/routes/vault/cluster/access/reset-password.ts","lineNumber":38,"sourceCode":"  async model() {\n    const { authMethodType, authMountPath, displayName } = this.auth.authData;\n    // Password reset is only available on userpass type auth mounts\n    if (authMethodType !== 'userpass') {\n      throw new Error(ERROR_UNAVAILABLE);\n    }\n\n    // Both of these are necessary to build the reset password URL\n    if (!authMountPath || !displayName) {\n      throw new Error(ERROR_UNAVAILABLE);\n    }\n\n    const capabilities = await this.capabilities.fetchPathCapabilities(\n      `auth/${authMountPath}/users/${displayName}/password`\n    );\n\n    // Throw an error if we know for certain the user doesn't have permission\n    if (!capabilities.canUpdate) {\n      throw new Error(ERROR_NO_ACCESS);\n    }\n    return {\n      backend: authMountPath,\n      username: displayName,\n    };\n  }\n}\n","sourceCodeStart":20,"sourceCodeEnd":46,"githubUrl":"https://github.com/hashicorp/vault/blob/744b611b5700b3b7f82d76b4d6938a91b9989367/ui/app/routes/vault/cluster/access/reset-password.ts#L20-L46","documentation":"Final guard in the reset-password route model (ui/app/routes/vault/cluster/access/reset-password.ts:38). The model fetches path capabilities for auth/<authMountPath>/users/<displayName>/password via the capabilities service; if the token cannot update that path (canUpdate false), it throws ERROR_NO_ACCESS directing the user to their administrator.","triggerScenarios":"The authenticated token's policy set lacks update on auth/userpass/users/<self>/password — e.g. a limited or default policy, a token minted by another system, or a policy path typo.","commonSituations":"Users whose ACLs deliberately exclude self-service password updates; policy written for the wrong mount path; tokens generated by orchestration tools with minimal capabilities.","solutions":["Ask an administrator to grant update on auth/<userpass-mount>/users/<name>/password in your policy","Verify what your token can do: vault token capabilities auth/userpass/users/<name>/password","Until granted, have an admin reset the password via vault write auth/userpass/users/<name>/password password=<new>"],"exampleFix":"// policy snippet that makes self-service reset work\npath \"auth/userpass/users/${identity.entity.aliases.auth_userpass_<mount>.name}/password\" {\n  capabilities = [\"update\"]\n}","handlingStrategy":"validation","validationCode":"// Pre-check capabilities before showing the reset form\nconst caps = await this.capabilities.fetchPathCapabilities(`auth/${authMountPath}/users/${displayName}/password`);\nif (!caps.canUpdate) {\n  renderNoAccessNotice(); // policy guidance instead of a thrown route error\n  return;\n}","typeGuard":null,"tryCatchPattern":"try {\n  await this.router.transitionTo('vault.cluster.access.reset-password');\n} catch (e) {\n  if (e.message.includes('ask your administrator to update your policy')) {\n    notifyUser('Your policy needs update on auth/<mount>/users/<name>/password for self-service reset');\n  } else {\n    throw e;\n  }\n}","preventionTips":["Include update on auth/userpass/users/<name>/password in baseline user policies","Verify grants with vault token capabilities before reporting an issue"],"tags":["auth","acl","capabilities","password","permissions"],"backgroundTag":null,"analyzedSha":"744b611b5700b3b7f82d76b4d6938a91b9989367","analyzedAt":"2026-08-15T14:40:29.333Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}