{"record":{"id":"9b8daadaf53f098c","repo":"apolloconfig/apollo","slug":"change-user-enabled-operation-is-forbidden","errorCode":null,"errorMessage":"Change user enabled operation is forbidden","messagePattern":"Change user enabled operation is forbidden","errorType":"exception","errorClass":"AccessDeniedException","httpStatus":403,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/UserController.java","lineNumber":126,"sourceCode":"    }\n\n    if (userService instanceof SpringSecurityUserService) {\n      if (Boolean.TRUE.equals(isCreate)) {\n        ((SpringSecurityUserService) userService).create(user);\n      } else {\n        ((SpringSecurityUserService) userService).update(user);\n      }\n    } else {\n      throw new UnsupportedOperationException(\"Create or update user operation is unsupported\");\n    }\n    return ResponseEntity.ok().build();\n  }\n\n  @Override\n  public ResponseEntity<Void> changeUserEnabled(OpenUserDTO openUserDTO, String operator) {\n    boolean consumerRequest = requireUserManagementMutationPermission(operator);\n    if (!consumerRequest && !unifiedPermissionValidator.isSuperAdmin()) {\n      throw new AccessDeniedException(\"Change user enabled operation is forbidden\");\n    }\n    UserPO user = OpenApiModelConverters.toUserPO(openUserDTO);\n    if (userService instanceof SpringSecurityUserService) {\n      ((SpringSecurityUserService) userService).changeEnabled(user);\n    } else {\n      throw new UnsupportedOperationException(\"change user enabled is unsupported\");\n    }\n    return ResponseEntity.ok().build();\n  }\n\n  private void requirePortalUserRequest() {\n    if (!isPortalUserIdentity()) {\n      throw new AccessDeniedException(\"Portal user session is required\");\n    }\n  }\n\n  private void requireUserManagementReadPermission() {\n    if (UserIdentityConstants.USER.equals(UserIdentityContextHolder.getAuthType())) {","sourceCodeStart":108,"sourceCodeEnd":144,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/v1/controller/UserController.java#L108-L144","documentation":"Thrown by changeUserEnabled for a portal user request when the caller is not a super admin. Only super admins (or tokens with manage-users permission) may enable or disable users.","triggerScenarios":"Thrown when a caller without the manage-users permission attempts to enable or disable a user account via the OpenAPI.","commonSituations":"Non-admin token or portal user calls the change-enabled endpoint.","solutions":["Call the endpoint as a super admin, or use a user token or consumer token granted the manage-users permission."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}