{"record":{"id":"8591d8e6ca56e424","repo":"passbolt/passbolt_api","slug":"you-are-not-authorized-to-access-that-location-8591d8","errorCode":null,"errorMessage":"You are not authorized to access that location.","messagePattern":"You are not authorized to access that location\\.","errorType":"exception","errorClass":"Cake\\Http\\Exception\\ForbiddenException","httpStatus":403,"severity":"error","filePath":"src/Controller/Users/UsersDeleteController.php","lineNumber":157,"sourceCode":"\n        $this->success(__('The user has been deleted successfully.'));\n    }\n\n    /**\n     * Assert request sanity and return the sanitized data\n     *\n     * @param string $id user uuid\n     * @throws \\Cake\\Http\\Exception\\ForbiddenException if current user is not an admin\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the user uuid id invalid\n     * @throws \\Cake\\Http\\Exception\\BadRequestException if the user tries to delete themselves\n     * @throws \\Cake\\Http\\Exception\\NotFoundException if the user does not exist or is already deleted\n     * @return \\App\\Model\\Entity\\User $user entity\n     */\n    protected function _validateRequestData(string $id)\n    {\n        // Admin can delete all users\n        if ($this->User->role() !== Role::ADMIN) {\n            throw new ForbiddenException(__('You are not authorized to access that location.'));\n        }\n        if (!Validation::uuid($id)) {\n            throw new BadRequestException(__('The user identifier should be a valid UUID.'));\n        }\n        // An admin cannot delete themselves\n        if ($id === $this->User->id()) {\n            throw new BadRequestException(__('You are not allowed to delete yourself.'));\n        }\n\n        /** @var \\App\\Model\\Entity\\User $user */\n        $user = $this->Users->findDelete($id, $this->User->role())->first();\n        if (empty($user)) {\n            throw new NotFoundException(__('The user does not exist or has been already deleted.'));\n        }\n\n        return $user;\n    }\n","sourceCodeStart":139,"sourceCodeEnd":175,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/src/Controller/Users/UsersDeleteController.php#L139-L175","documentation":"Thrown by UsersDeleteController::_validateRequestData when the authenticated user's role is not ADMIN. Deleting users (and the dry-run variant) is restricted to administrators; everyone else receives a generic 403.","triggerScenarios":"DELETE /users/<id>.json or its dry-run executed by a 'user' or 'guest' role account.","commonSituations":"Automation using a non-admin service account; an admin whose role was downgraded but whose client still calls admin endpoints; hitting the wrong environment where the account is not an admin.","solutions":["Use an administrator account for user deletion requests.","Grant the required role via another admin if the operation is legitimate.","For self-service removal, use the appropriate self-delete/profile flow instead of the admin delete endpoint."],"exampleFix":"// before\nawait api.delete(`/users/${id}.json`); // as role=user -> 403\n// after\nconst adminApi = createClient({ token: adminToken });\nawait adminApi.delete(`/users/${id}.json`);","handlingStrategy":"validation","validationCode":"const me = await api.get('/users/me.json');\nif (me.body.role.name !== 'admin') throw new Error('deleting users requires an admin account');","typeGuard":"function isAdmin(session) { return session?.role?.name === 'admin'; }","tryCatchPattern":"try { await api.delete(`/users/${id}.json`); } catch (e) { if (e.status === 403 && /not authorized to access that location/.test(e.message)) { elevateToAdmin(); } else throw e; }","preventionTips":["Gate all admin-only client code behind a role check at startup","Keep automation service accounts admin if they must manage users","Re-verify role after any server-side role changes"],"tags":["authorization","users","delete","forbidden"],"backgroundTag":"insufficient-permissions","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}