{"record":{"id":"fbbddb427c1d823c","repo":"passbolt/passbolt_api","slug":"you-are-not-allowed-to-access-this-location-fbbddb","errorCode":null,"errorMessage":"You are not allowed to access this location.","messagePattern":"You are not allowed to access this location\\.","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"plugins/PassboltCe/MultiFactorAuthentication/src/Controller/UserSettings/MfaUserSettingsDeleteController.php","lineNumber":56,"sourceCode":"    /**\n     * @return void\n     */\n    public function initialize(): void\n    {\n        parent::initialize();\n\n        $this->Users = $this->fetchTable('Users');\n    }\n\n    /**\n     * @inheritDoc\n     */\n    public function beforeFilter(EventInterface $event)\n    {\n        $userId = $this->getRequest()->getParam('userId', null);\n\n        if (!$this->isAllowed($userId)) {\n            throw new ForbiddenException(__('You are not allowed to access this location.'));\n        }\n\n        parent::beforeFilter($event);\n    }\n\n    /**\n     * @param string|null $userId UUID of the user for which MFA config must be deleted\n     * @return void\n     */\n    public function delete(?string $userId = null)\n    {\n        if (!Validation::uuid($userId)) {\n            throw new BadRequestException(__('The user id is not valid.'));\n        }\n\n        try {\n            /** @var \\App\\Model\\Entity\\User $user */\n            $user = $this->Users->findView($userId, $this->User->role())->find('locale')->firstOrFail();","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/passbolt/passbolt_api/blob/31c1bbc10f32808a607fa9bd81891e898779c0bc/plugins/PassboltCe/MultiFactorAuthentication/src/Controller/UserSettings/MfaUserSettingsDeleteController.php#L38-L74","documentation":"The MFA user-settings DELETE endpoint throws a ForbiddenException in `beforeFilter` when the requesting user is not allowed to manage MFA settings for the targeted `userId`. `isAllowed()` only permits an admin or the user deleting their own settings.","triggerScenarios":"A non-admin user calling DELETE /mfa/user/settings/<anotherUserUuid>.json; an anonymous request with no userId in the route; a logged-in user whose role is 'user' targeting anyone but themselves.","commonSituations":"Frontend sending the wrong user id in the URL (e.g. logged-in user id vs. target id swapped); missing admin role because the user's account was downgraded; calling the endpoint while the session has expired so `$this->User` is anonymous.","solutions":["Ensure the userId route parameter matches the authenticated user, or authenticate as an admin","Check the user's role in the response of GET /users.json (role.name === 'admin')","Log in again if the session expired","If an admin still gets 403, verify the route parameter placeholder name matches `userId`"],"exampleFix":"// before\nawait fetch(`/mfa/user/settings/${targetUserId}.json`, {method:'DELETE'});\n// after (guard client-side too)\nif (isAdmin || targetUserId === loggedInUserId) {\n  await fetch(`/mfa/user/settings/${targetUserId}.json`, {method:'DELETE'});\n}","handlingStrategy":"validation","validationCode":"const canDelete = (me, targetUserId) => me.role?.name === 'admin' || me.id === targetUserId;\nif (!canDelete(currentUser, userId)) throw new Error('Not allowed to delete MFA settings for this user');","typeGuard":"null","tryCatchPattern":"try { await deleteMfaUserSettings(userId); } catch (e) {\n  if (e.response?.status === 403) notify('Only admins or the owner can delete MFA settings');\n}","preventionTips":["Verify the target userId equals the logged-in user unless operating as admin","Check role.name === 'admin' before exposing admin-only MFA actions in the UI","Refresh the session before admin operations to avoid anonymous 403s"],"tags":["permissions","forbidden","mfa","authorization"],"backgroundTag":"permission-denied","analyzedSha":"31c1bbc10f32808a607fa9bd81891e898779c0bc","analyzedAt":"2026-09-17T00:04:38.960Z","contentChangedAt":"2026-09-17T00:04:38.960Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}