{"record":{"id":"98b49685d7f2f37e","repo":"overleaf/overleaf","slug":"confirm-email-wrong-user","errorCode":"confirm-email-wrong-user","errorMessage":"We can’t confirm this email. You must be logged in with the Overleaf account that requested the new secondary email.","messagePattern":"We can’t confirm this email\\. You must be logged in with the Overleaf account that requested the new secondary email\\.","errorType":"http","errorClass":"ForbiddenError","httpStatus":403,"severity":"error","filePath":"services/web/app/src/Features/User/UserEmailsController.mjs","lineNumber":653,"sourceCode":"\n  primaryEmailCheck: expressify(primaryEmailCheck),\n\n  showConfirm: expressify(showConfirm),\n\n  confirm(req, res, next) {\n    const { token } = req.body\n    if (!token) {\n      return res.status(422).json({\n        message: req.i18n.translate('confirmation_link_broken'),\n      })\n    }\n    UserEmailsConfirmationHandler.confirmEmailFromToken(\n      req,\n      token,\n      function (error, userData) {\n        if (error) {\n          if (error instanceof Errors.ForbiddenError) {\n            res.status(403).json({\n              message: {\n                key: 'confirm-email-wrong-user',\n                text: `We can’t confirm this email. You must be logged in with the Overleaf account that requested the new secondary email.`,\n              },\n            })\n          } else if (error instanceof Errors.NotFoundError) {\n            res.status(404).json({\n              message: req.i18n.translate('confirmation_token_invalid'),\n            })\n          } else {\n            next(error)\n          }\n        } else {\n          const { userId, email } = userData\n          const tokenPrefix = token.substring(0, AUDIT_LOG_TOKEN_PREFIX_LENGTH)\n          UserAuditLogHandler.addEntry(\n            userId,\n            'confirm-email',","sourceCodeStart":635,"sourceCodeEnd":671,"githubUrl":"https://github.com/overleaf/overleaf/blob/28ad3b03b71cb4311decdcb55c36b33ec10d72db/services/web/app/src/Features/User/UserEmailsController.mjs#L635-L671","documentation":"Error branch in confirm: UserEmailsConfirmationHandler.confirmEmailFromToken threw Errors.ForbiddenError, meaning the confirmation token is valid but the currently logged-in account is not the one that requested the secondary email; rejected with 403 key 'confirm-email-wrong-user'.","triggerScenarios":"Thrown at services/web/app/src/Features/User/UserEmailsController.mjs:653 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Log in with the account that added the secondary email, then confirm","Request the confirmation from the correct account so the token matches"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"28ad3b03b71cb4311decdcb55c36b33ec10d72db","analyzedAt":"2026-09-03T02:10:22.807Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T07:17:11.731Z"}