django/django · error · Http404

Your user does not have the "Change user" permission. In ord

Error message

Your user does not have the "Change user" permission. In order to add users, Django requires that your user account have both the "Add user" and "Change user" permissions set.

What it means

Raised as Http404 (only when settings.DEBUG=True, else PermissionDenied) by UserAdmin._add_view when the current user has add_user permission but lacks change_user permission. Django forbids granting the ability to create users without the ability to edit them, because an add-only user could create a superuser and thereby gain change power.

Source

Thrown at django/contrib/auth/admin.py:132

    def add_view(self, request, form_url="", extra_context=None):
        if request.method in ("GET", "HEAD", "OPTIONS", "TRACE"):
            return self._add_view(request, form_url, extra_context)

        with transaction.atomic(using=router.db_for_write(self.model)):
            return self._add_view(request, form_url, extra_context)

    def _add_view(self, request, form_url="", extra_context=None):
        # It's an error for a user to have add permission but NOT change
        # permission for users. If we allowed such users to add users, they
        # could create superusers, which would mean they would essentially have
        # the permission to change users. To avoid the problem entirely, we
        # disallow users from adding users if they don't have change
        # permission.
        if not self.has_change_permission(request):
            if self.has_add_permission(request) and settings.DEBUG:
                # Raise Http404 in debug mode so that the user gets a helpful
                # error message.
                raise Http404(
                    'Your user does not have the "Change user" permission. In '
                    "order to add users, Django requires that your user "
                    'account have both the "Add user" and "Change user" '
                    "permissions set."
                )
            raise PermissionDenied
        if extra_context is None:
            extra_context = {}
        username_field = self.opts.get_field(self.model.USERNAME_FIELD)
        defaults = {
            "auto_populated_fields": (),
            "username_help_text": username_field.help_text,
        }
        extra_context.update(defaults)
        return super().add_view(request, form_url, extra_context)

    @method_decorator(sensitive_post_parameters())
    def user_change_password(self, request, id, form_url=""):

View on GitHub (pinned to ae25a40be0)

Solutions

Grant the user both 'auth.add_user' and 'auth.change_user' permissions.
If the restriction is intentional, remove add_user so the user simply cannot add users.
Review custom permission backends/groups to ensure add and change are assigned together for the User model.

Example fix

// before: only add permission
user.user_permissions.add(
    Permission.objects.get(codename="add_user"),
)

// after: add + change together
user.user_permissions.add(
    Permission.objects.get(codename="add_user"),
    Permission.objects.get(codename="change_user"),
)

Defensive patterns

Strategy: validation

Validate before calling

# Ensure add_user and change_user are granted together.
from django.contrib.auth.models import Permission

def grant_user_admin_perms(user):
    perms = Permission.objects.filter(codename__in=('add_user', 'change_user'))
    missing = set(perms) - set(user.user_permissions.all())
    if missing:
        user.user_permissions.add(*missing)
    return len(missing) == 0  # True if both are now present

Try / catch

from django.http import Http404
from django.core.exceptions import PermissionDenied

try:
    return user_admin.add_view(request)
except (Http404, PermissionDenied):
    # surface 'add_user requires change_user' to the operator
    messages.error(request, 'Grant both auth.add_user and auth.change_user.')
    return redirect('admin:index')

Prevention

Always assign auth.add_user and auth.change_user as a pair in groups/backends.
Add a system check that flags roles granting one without the other.
In DEBUG, read the explanatory Http404 message; it names the missing permission.

When it happens

Trigger: An admin user is assigned the 'auth.add_user' permission but not 'auth.change_user', then opens the add-user form. In DEBUG the explanatory Http404 is shown; in production they get a 403 PermissionDenied.

Common situations: Custom permission groups or per-object permission backends that grant add_user in isolation; promoting a staff member with limited perms; permission import scripts that set add without change.

Related errors

AI-assisted analysis of django/django@ae25a40be0 (2026-08-06). Data as JSON: /api/errors/46654e9cc8a0c3ca. Report an issue: GitHub.