{"record":{"id":"f1a921e4b006b996","repo":"weaviate/weaviate","slug":"unauthorized-to-access-collection-s","errorCode":null,"errorMessage":"unauthorized to access collection %s","messagePattern":"unauthorized to access collection (.+?)","errorType":"http","errorClass":"Error","httpStatus":403,"severity":"error","filePath":"usecases/objects/query.go","lineNumber":104,"sourceCode":"\tm.metrics.GetObjectInc()\n\tdefer m.metrics.GetObjectDec()\n\n\tq, err := params.inputs(m)\n\tif err != nil {\n\t\treturn nil, &Error{\"offset or limit\", StatusBadRequest, err}\n\t}\n\n\tfilteredQuery := filter.New[*QueryInput](m.authorizer, m.config.Config.Authorization.Rbac).Filter(\n\t\tctx,\n\t\tprincipal,\n\t\t[]*QueryInput{q},\n\t\tauthorization.READ,\n\t\tfunc(qi *QueryInput) string {\n\t\t\treturn authorization.CollectionsData(qi.Class)[0]\n\t\t},\n\t)\n\tif len(filteredQuery) == 0 {\n\t\terr = fmt.Errorf(\"unauthorized to access collection %s\", q.Class)\n\t\treturn nil, &Error{err.Error(), StatusForbidden, err}\n\t}\n\n\tres, rerr := m.vectorRepo.Query(ctx, filteredQuery[0])\n\tif rerr != nil {\n\t\treturn nil, rerr\n\t}\n\n\tif m.modulesProvider != nil {\n\t\tres, err = m.modulesProvider.ListObjectsAdditionalExtend(ctx, res, q.Additional.ModuleParams)\n\t\tif err != nil {\n\t\t\treturn nil, &Error{\"extend results\", StatusInternalServerError, err}\n\t\t}\n\t}\n\n\tif q.Additional.Vector {\n\t\tm.trackUsageList(res)\n\t}","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/weaviate/weaviate/blob/75aa4b6d11f8818305aafd4440b4e32794f7ca04/usecases/objects/query.go#L86-L122","documentation":"Query authorizes the resolved collection via the RBAC filter; when the filter drops the only query input, the manager knows the principal lacks READ on that collection and returns this 403 error. It is the list-objects endpoint's way of saying the authenticated user/role is not allowed to read the requested collection.","triggerScenarios":"GET /v1/objects?class=Article (list objects) where the principal's roles grant no READ on \"Article\"; listing with class \"*\" but filtered out to an empty set for a restricted user; querying a qualified namespace class the principal cannot read.","commonSituations":"RBAC misconfiguration after migrating to role-based auth; API key or OIDC user mapped to a role without collections-data read; forgetting to add read permissions after creating a new collection.","solutions":["Grant the principal's role READ on the collection: add the collection to the role's collections-data permissions","Verify which user/key the request authenticates as (check logs/Authorization header)","Inspect current permissions with the roles API and compare against the queried class name","If a wildcard listing is intended, ensure the user has read rights on all collections or scope the query to allowed ones"],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":"// check permissions before listing\nallowed, err := authz.HasCollectionsDataRead(ctx, principal, className)\nif err != nil || !allowed {\n    return fmt.Errorf(\"no READ permission on %s\", className)\n}","typeGuard":"func canRead(principal *models.Principal, class string) bool {\n    return principal != nil && roleGrantsRead(principal.Roles, class)\n}","tryCatchPattern":"if err != nil {\n    var e *objects.Error\n    if errors.As(err, &e) && e.StatusCode == 403 {\n        // surface which collection was denied; do not retry\n    }\n}","preventionTips":["Assign roles with collections-data READ when creating users/keys","Audit permissions after creating new collections","List collections the principal may read instead of querying \"*\""],"tags":["authorization","rbac","http-get","forbidden"],"backgroundTag":"unauthorized-collection-access","analyzedSha":"75aa4b6d11f8818305aafd4440b4e32794f7ca04","analyzedAt":"2026-09-04T14:58:20.392Z","contentChangedAt":"2026-09-04T14:58:20.392Z","schemaVersion":2},"datasetVersion":"2026-09-11T21:17:09.523Z"}