{"record":{"id":"b50760eeefdfd47e","repo":"RocketChat/Rocket.Chat","slug":"error-not-allowed-b50760","errorCode":"error-not-allowed","errorMessage":"Change avatar is not allowed","messagePattern":"Change avatar is not allowed","errorType":"exception","errorClass":"Meteor.Error","httpStatus":400,"severity":"error","filePath":"apps/meteor/server/api/v1/users.ts","lineNumber":291,"sourceCode":"\t\t},\n\t)\n\t.post(\n\t\t'users.setAvatar',\n\t\t{\n\t\t\tauthRequired: true,\n\t\t\tbody: isUsersSetAvatarProps,\n\t\t\tresponse: {\n\t\t\t\t200: voidSuccessResponse,\n\t\t\t\t400: validateBadRequestErrorResponse,\n\t\t\t\t401: validateUnauthorizedErrorResponse,\n\t\t\t\t403: validateForbiddenErrorResponse,\n\t\t\t},\n\t\t},\n\t\tasync function action() {\n\t\t\tconst canEditOtherUserAvatar = await hasPermissionAsync(this.user, 'edit-other-user-avatar');\n\n\t\t\tif (!settings.get('Accounts_AllowUserAvatarChange') && !canEditOtherUserAvatar) {\n\t\t\t\tthrow new Meteor.Error('error-not-allowed', 'Change avatar is not allowed', {\n\t\t\t\t\tmethod: 'users.setAvatar',\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tlet user = await (async (): Promise<Pick<IUser, '_id' | 'username'> | undefined | null> => {\n\t\t\t\tif (isUserFromParams(this.bodyParams, this.userId, this.user)) {\n\t\t\t\t\treturn Users.findOneById(this.userId);\n\t\t\t\t}\n\t\t\t\tif (canEditOtherUserAvatar) {\n\t\t\t\t\treturn getUserFromParams(this.bodyParams);\n\t\t\t\t}\n\t\t\t})();\n\n\t\t\tif (!user) {\n\t\t\t\treturn API.v1.forbidden();\n\t\t\t}\n\n\t\t\tif (this.bodyParams.avatarUrl) {","sourceCodeStart":273,"sourceCodeEnd":309,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/server/api/v1/users.ts#L273-L309","documentation":"Thrown by users.setAvatar when the workspace setting Accounts_AllowUserAvatarChange is false AND the caller has no edit-other-user-avatar permission. This is the global 'avatar changes are disabled' guard, raised before any user is resolved.","triggerScenarios":"POST users.setAvatar on a workspace where the admin disabled Accounts_AllowUserAvatarChange, by a user who is not an avatar admin.","commonSituations":"Self-hosted workspace locked down avatars; admin toggled the setting after customisation; default policy in restricted deployments.","solutions":["An admin must enable Accounts_AllowUserAvatarChange, or grant the caller edit-other-user-avatar.","Use a different avatar source (URL/Gravatar) if uploads are disabled.","Confirm the policy with the workspace admin before attempting uploads."],"exampleFix":"null","handlingStrategy":"validation","validationCode":"// Read the setting (exposed via settings.get public API) before showing the control\nconst allowed = await settingsPublic['Accounts_AllowUserAvatarChange'];\nif (!allowed && !hasRole('edit-other-user-avatar')) hideAvatarUpload();","typeGuard":"null","tryCatchPattern":"try {\n  await POST('users.setAvatar', form);\n} catch (e) {\n  if (isMeteorError(e, 'error-not-allowed')) {\n    // tell the user avatar changes are disabled by the admin\n  } else { throw e; }\n}","preventionTips":["Gating the UI on Accounts_AllowUserAvatarChange avoids the failed call.","Surface admin-only alternatives when the setting is off."],"tags":["users","avatar","permissions","settings","api"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}