{"record":{"id":"ac0344b8f4d7ed87","repo":"hyperledger/fabric","slug":"tx-creator-does-not-have-read-access-permission-on","errorCode":null,"errorMessage":"tx creator does not have read access permission on privatedata in chaincodeName:%s collectionName: %s","messagePattern":"tx creator does not have read access permission on privatedata in chaincodeName:(.+?) collectionName: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"core/chaincode/handler.go","lineNumber":638,"sourceCode":"func (h *Handler) checkPurgePrivateDataCap(channelId string) error {\n\tac, exists := h.AppConfig.GetApplicationConfig(channelId)\n\tif !exists {\n\t\treturn errors.Errorf(\"application config does not exist for %s\", channelId)\n\t}\n\n\tif !ac.Capabilities().PurgePvtData() {\n\t\treturn errors.New(\"purge private data is not enabled, channel application capability of V2_5 or later is required\")\n\t}\n\treturn nil\n}\n\nfunc errorIfCreatorHasNoReadPermission(chaincodeName, collection string, txContext *TransactionContext) error {\n\trwPermission, err := getReadWritePermission(chaincodeName, collection, txContext)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif !rwPermission.read {\n\t\treturn errors.Errorf(\"tx creator does not have read access permission on privatedata in chaincodeName:%s collectionName: %s\",\n\t\t\tchaincodeName, collection)\n\t}\n\treturn nil\n}\n\nfunc errorIfCreatorHasNoWritePermission(chaincodeName, collection string, txContext *TransactionContext) error {\n\trwPermission, err := getReadWritePermission(chaincodeName, collection, txContext)\n\tif err != nil {\n\t\treturn err\n\t}\n\tif !rwPermission.write {\n\t\treturn errors.Errorf(\"tx creator does not have write access permission on privatedata in chaincodeName:%s collectionName: %s\",\n\t\t\tchaincodeName, collection)\n\t}\n\treturn nil\n}\n\nfunc getReadWritePermission(chaincodeName, collection string, txContext *TransactionContext) (*readWritePermission, error) {","sourceCodeStart":620,"sourceCodeEnd":656,"githubUrl":"https://github.com/hyperledger/fabric/blob/2736b63f8fd5932511d56fe68b7039d15977f7f6/core/chaincode/handler.go#L620-L656","documentation":"errorIfCreatorHasNoReadPermission enforces private data collection access control: the transaction creator must have read permission on the collection per its memberOrgsPolicy. This error means the tx creator's organization is not in the collection's read (memberOrgsPolicy) policy for the given chaincode/collection, so GetState-style private data reads are denied.","triggerScenarios":"Chaincode calls GetPrivateData / GetPrivateDataMetadata / GetPrivateDataByRange / GetPrivateDataQueryResult on a collection whose memberOrgsPolicy read config does not include the tx creator's org; reading from a collection during endorsement by an org outside the read list.","commonSituations":"Orgs added to a collection's peers list but not to its read policy; developers testing cross-org reads on restricted collections; collection definitions copied from templates without adjusting requiredPeerCount/memberOrgsPolicy; wrong org MSP configured for the submitting client.","solutions":["Update the collection definition (collections_config.json) so memberOrgsPolicy includes the org needing read access, and re-commit with the chaincode upgrade","Issue the read from a client/transactor whose org is listed in the collection's read policy","Verify the client's MSP identity matches the expected org","If reads shouldn't be possible, catch and handle the denied access in chaincode instead of failing the tx unexpectedly"],"exampleFix":"// before: collections_config.json\n\"memberOrgsPolicy\": { \"type\": \"SIGNATURE\", \"rule\": \"OR('Org1MSP.peer')\" }\n// after: grant Org2 read\n\"memberOrgsPolicy\": { \"type\": \"SIGNATURE\", \"rule\": \"OR('Org1MSP.peer', 'Org2MSP.peer')\" }","handlingStrategy":"try-catch","validationCode":"// review collections_config.json read policy before deploying:\n// memberOrgsPolicy must contain every org that will read the collection","typeGuard":null,"tryCatchPattern":"val, err := stub.GetPrivateData(\"coll1\", key)\nif err != nil && strings.Contains(err.Error(), \"does not have read access permission\") {\n    return shim.Error(\"org not authorized to read this collection; check memberOrgsPolicy\")\n}\nif err != nil { return shim.Error(err.Error()) }","preventionTips":["Keep read and write policies in collections_config.json explicitly reviewed per org","Test private data access from every member org in CI before production commit","Remember policy changes require a chaincode re-commit/upgrade","Verify the client identity's org MSP matches an org in the read policy"],"tags":["hyperledger-fabric","private-data","access-control","collections"],"backgroundTag":"private-data-access-denied","analyzedSha":"2736b63f8fd5932511d56fe68b7039d15977f7f6","analyzedAt":"2026-09-04T08:52:36.465Z","contentChangedAt":"2026-09-04T08:52:36.465Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}