{"record":{"id":"e66a5af2579d3cb8","repo":"payloadcms/payload","slug":"you-are-not-allowed-to-perform-this-action-e66a5a","errorCode":null,"errorMessage":"You are not allowed to perform this action.","messagePattern":"You are not allowed to perform this action\\.","errorType":"http","errorClass":"Forbidden","httpStatus":403,"severity":"error","filePath":"packages/payload/src/globals/operations/findVersionByID.ts","lineNumber":100,"sourceCode":"      where: combineQueries({ id: { equals: id } }, accessResults),\n    }\n\n    // /////////////////////////////////////\n    // Find by ID\n    // /////////////////////////////////////\n\n    if (!findGlobalVersionsArgs.where?.and?.[0]?.id) {\n      throw new NotFound(req.t)\n    }\n\n    const { docs: results } = await payload.db.findGlobalVersions(findGlobalVersionsArgs)\n    if (!results || results?.length === 0) {\n      if (!disableErrors) {\n        if (!hasWhereAccess) {\n          throw new NotFound(req.t)\n        }\n        if (hasWhereAccess) {\n          throw new Forbidden(req.t)\n        }\n      }\n\n      return null!\n    }\n\n    // Clone the result - it may have come back memoized\n    let result: any = deepCopyObjectSimple(results[0])\n\n    if (!result.version) {\n      result.version = {}\n    }\n\n    // Patch globalType onto version doc\n    result.version.globalType = globalConfig.slug\n\n    // /////////////////////////////////////\n    // beforeRead - Collection","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/payloadcms/payload/blob/00c58b35c0ed348ddc22daabf467b139727214fd/packages/payload/src/globals/operations/findVersionByID.ts#L82-L118","documentation":"Thrown by findVersionByIDOperation when the version lookup returns nothing but the caller is subject to a where-based access-control result (access returned a query object rather than a boolean). Payload interprets an empty result under a where-constraint as 'forbidden' rather than 'not found', to avoid leaking the existence of versions the user cannot read. Surfaced as HTTP 403 Forbidden.","triggerScenarios":"Calling findVersionByID with overrideAccess:false where globalConfig.access.readVersions returned a Where query, and either the version does not exist or the user's constraint excludes it. GET /globals/:slug/versions/:id by a user whose readVersions access narrows the visible set.","commonSituations":"Role-based tenants where readVersions returns { tenant: { equals: user.tenant } } and the requested version belongs to another tenant; tightening access rules after versions were created; a logged-in user whose access function returns a query that no version satisfies.","solutions":["Confirm the authenticated user actually satisfies the readVersions constraint for that version.","If callers legitimately need to probe existence, pass disableErrors:true and treat null as 'not visible'.","Audit the readVersions access function — returning a Where object turns every miss into 403; ensure the query matches how versions store the gating field.","For server-side privileged reads, set overrideAccess:true to bypass the where-constraint path."],"exampleFix":"// before\nconst v = await payload.findGlobalVersionByID({ id, global: 'branding', overrideAccess: false })\n\n// after\nconst v = await payload.findGlobalVersionByID({\n  id,\n  global: 'branding',\n  overrideAccess: false,\n  disableErrors: true,\n})\nif (v === null) {\n  // could be missing OR not permitted — handle as 'unavailable'\n}","handlingStrategy":"try-catch","validationCode":"const allowed = await executeAccess(\n  { id, slug, req },\n  globalConfig.access.readVersions,\n)\n// if typeof allowed === 'object', a miss becomes Forbidden — handle null","typeGuard":"function isWhereAccess(\n  r: boolean | object,\n): r is object {\n  return typeof r === 'object'\n}","tryCatchPattern":"try {\n  return await payload.findGlobalVersionByID({ id, global: slug, overrideAccess: false })\n} catch (err) {\n  if (err instanceof Forbidden) return null // treat as 'not visible'\n  throw err\n}","preventionTips":["Make readVersions return a query that matches the field actually stored on versions.","Use disableErrors:true to fold missing+forbidden into a single null result."],"tags":["globals","versions","forbidden","access-control","local-api"],"backgroundTag":null,"analyzedSha":"00c58b35c0ed348ddc22daabf467b139727214fd","analyzedAt":"2026-08-12T20:45:03.758Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}