bitwarden/server · error · UnauthorizedAccessException

Not authorized.

Error message

Not authorized.

What it means

An UnauthorizedAccessException (HTTP 401/403) thrown by RequirePermissionAttribute.OnActionExecuting when the authenticated admin user does not have the required Permission flag as determined by IAccessControlService.UserHasPermission. This is the admin panel's authorization gate for every action decorated with [RequirePermission].

Source

Thrown at src/Admin/Utilities/RequirePermissionAttribute.cs:23

namespace Bit.Admin.Utilities;

public class RequirePermissionAttribute : ActionFilterAttribute
{
    public Permission Permission { get; set; }

    public RequirePermissionAttribute(Permission permission)
    {
        Permission = permission;
    }

    public override void OnActionExecuting(ActionExecutingContext context)
    {
        var accessControlService = context.HttpContext.RequestServices.GetRequiredService<IAccessControlService>();

        var hasPermission = accessControlService.UserHasPermission(Permission);
        if (!hasPermission)
        {
            throw new UnauthorizedAccessException("Not authorized.");
        }
    }
}

View on GitHub (pinned to e93b962371)

Solutions

1. Verify the user's admin role includes the required Permission flag (check the role configuration in the admin portal or database).
2. If using the access control service with a permissions JSON/config, ensure the config grants the needed permission to the user's role.
3. For local development, confirm the admin user seed/configuration assigns the expected permissions.
4. If permissions were recently changed, have the user log out and back in to refresh their permission claims.

// Global admin exception filter
catch (UnauthorizedAccessException)
{ return View("AccessDenied"); }

When it happens

Trigger: Any admin panel action decorated with [RequirePermission(X)] is invoked by a user whose role does not grant permission X. The attribute runs as an MVC action filter before the controller method executes.

Common situations: A read-only admin role attempts a write action. A newly created admin account hasn't been granted the necessary permissions. Permission definitions were changed (enum updated) without migrating role assignments. A developer tests locally without proper admin role configuration.

Related errors

• Unauthorized.
• Invalid permissions.
• Unauthorized.
• You do not have permission to create a connection of type {m
• You do not have permission to update this connection.

AI-assisted analysis of bitwarden/server@e93b962371 (2026-08-13). Data as JSON: /api/errors/18848ac837f6ca69. Report an issue: GitHub.