{"record":{"id":"faab0f7b38256926","repo":"langflow-ai/langflow","slug":"custom-component-creation-is-restricted-to-adminis","errorCode":null,"errorMessage":"Custom component creation is restricted to administrators","messagePattern":"Custom component creation is restricted to administrators","errorType":"http","errorClass":"HTTPException","httpStatus":403,"severity":"error","filePath":"src/backend/base/langflow/api/v1/endpoints.py","lineNumber":1374,"sourceCode":"    if _requires_component_hash_lookups(settings, user):\n        # Lazily compute hash lookups if they haven't been built yet\n        # (e.g. during startup before the cache is fully populated).\n        get_component_hash_lookups_for_validation()\n        all_known = component_cache.all_known_hashes\n        if all_known is None:\n            raise HTTPException(\n                status_code=status.HTTP_503_SERVICE_UNAVAILABLE,\n                detail=\"Component templates are still initializing. Please try again in a few seconds.\",\n            )\n\n    # In admin-only mode, non-admin users may create/refresh only known server\n    # templates. Truly custom code creation remains restricted to administrators.\n    if (\n        getattr(settings, \"custom_component_admin_only\", False) is True\n        and not user.is_superuser\n        and not code_hash_matches_any_template(raw_code.code, all_known)\n    ):\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail=\"Custom component creation is restricted to administrators\",\n        )\n\n    if not settings.allow_custom_components and not code_hash_matches_any_template(raw_code.code, all_known):\n        # Allow updating to a known server template (core component update),\n        # but block truly custom code.\n        raise HTTPException(\n            status_code=status.HTTP_403_FORBIDDEN,\n            detail=\"Custom component creation is disabled\",\n        )\n\n    # In restricted mode the request only reached here by matching a known\n    # template hash. That hash is a truncated digest, so a second-preimage\n    # collision could clear the gate with attacker-controlled bytes. Execute\n    # the server's trusted copy keyed by the same hash instead of the client\n    # bytes, and fail closed if no trusted source can be recovered.\n    effective_code = raw_code.code","sourceCodeStart":1356,"sourceCodeEnd":1392,"githubUrl":"https://github.com/langflow-ai/langflow/blob/976ec789d2886a86de109c044d089d68e96c9a35/src/backend/base/langflow/api/v1/endpoints.py#L1356-L1392","documentation":"Error \"Custom component creation is restricted to administrators\" thrown in langflow-ai/langflow.","triggerScenarios":"Occurs when a non-administrator user attempts to create a custom component while admin-only creation is enforced.","commonSituations":"See trigger scenarios.","solutions":["Perform the operation as an administrator, or ask an admin to grant the required permission."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"976ec789d2886a86de109c044d089d68e96c9a35","analyzedAt":"2026-08-14T18:23:12.227Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}