{"record":{"id":"f814e29545c20d59","repo":"invoke-ai/InvokeAI","slug":"not-authorized-to-access-this-image","errorCode":null,"errorMessage":"Not authorized to access this image","messagePattern":"Not authorized to access this image","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"invokeai/app/api/routers/_access.py","lineNumber":112,"sourceCode":"\n    owner = ApiDependencies.invoker.services.image_records.get_user_id(image_name)\n    if owner is not None and owner == current_user.user_id:\n        return\n\n    board_id = ApiDependencies.invoker.services.board_image_records.get_board_for_image(image_name)\n    if board_id is not None:\n        # See `assert_image_owner` for why this reads the board record and catches only\n        # not-found: a lookup that cannot be decided must not present as a permission decision.\n        try:\n            board = ApiDependencies.invoker.services.board_records.get(board_id)\n        except BoardRecordNotFoundException:\n            pass\n        else:\n            if board.board_visibility in (BoardVisibility.Shared, BoardVisibility.Public):\n                return\n\n    _assert_image_record_exists(image_name)\n    raise HTTPException(status_code=403, detail=\"Not authorized to access this image\")\n\n\ndef assert_board_read_access(board_id: str, current_user: CurrentUserOrDefault) -> None:\n    \"\"\"Raise 403 if the current user may not read images from this board.\n\n    Access is granted when ANY of these hold:\n    - The user is an admin.\n    - The user owns the board.\n    - The board visibility is Shared or Public.\n    \"\"\"\n    if current_user.is_admin:\n        return\n\n    try:\n        board = ApiDependencies.invoker.services.boards.get_dto(board_id=board_id)\n    except Exception:\n        raise HTTPException(status_code=404, detail=\"Board not found\")\n","sourceCodeStart":94,"sourceCodeEnd":130,"githubUrl":"https://github.com/invoke-ai/InvokeAI/blob/0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06/invokeai/app/api/routers/_access.py#L94-L130","documentation":"`assert_image_read_access` raises this 403 when a non-admin user may not view an image: they are not the owner and the image's board is not Shared or Public. It fires only after confirming the image still exists (a missing image yields 404 instead).","triggerScenarios":"GET on any image-read endpoint (/v1/images/i/{image_name}, thumbnails, metadata, upload URLs) where the user is not admin, does not own the image row, and the image's board visibility is Private (or its board is missing), in multiuser mode.","commonSituations":"Another user's private-board image linked into your workflow; a shared URL opened by a different account; board visibility changed from Shared back to Private, breaking previously working references.","solutions":["Ask the image owner to move the image to a Shared or Public board","Have an admin fetch the image or grant your account ownership/admin rights","If you own the board containing the image, flip the board to Shared/Public via PATCH /v1/boards/{board_id}","Verify you are authenticated with the intended account (token may belong to a different user than expected)"],"exampleFix":"// before\nawait fetch(`/v1/images/i/${foreignImageName}`); // 403 on private board\n// after\nawait fetch(`/v1/boards/${boardId}`, { method: 'PATCH', body: JSON.stringify({ board_visibility: 'shared' }) });\nawait fetch(`/v1/images/i/${foreignImageName}`);","handlingStrategy":"try-catch","validationCode":"// Verify board visibility before sharing image references across users\nconst board = await fetch(`/v1/boards/${boardId}`, {headers: authHeaders}).then(r => r.json());\nif (!['shared','public'].includes(board.board_visibility)) console.warn('Board is private; other users cannot read its images');","typeGuard":"function canReadImage(image, user, board) {\n  return user.is_admin || image.user_id === user.user_id ||\n    (board && ['shared','public'].includes(board.board_visibility));\n}","tryCatchPattern":"try {\n  const img = await fetch(`/v1/images/i/${imageName}`, {headers: authHeaders});\n  if (img.status === 403) throw new ForbiddenError();\n  return await img.json();\n} catch (e) {\n  if (e instanceof ForbiddenError) showAccessDeniedNotice(imageName); // request Shared/Public board\n  else throw e;\n}","preventionTips":["Before cross-user sharing, move images to a Shared or Public board","Embed only images from shared/public boards in shared workflows","Check the current user token matches the intended account in multiuser setups","Distinguish 403 from 404: denied images may become readable; gone ones will not"],"tags":["auth","forbidden","image","multiuser","board-visibility"],"backgroundTag":"insufficient-permissions-403","analyzedSha":"0b6a024f2ff6a86bfb953dcdb9cc504ef7397a06","analyzedAt":"2026-08-29T04:46:49.967Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}