getredash/redash · error

Incorrect current password.

Error message

Incorrect current password.

What it means

Raised by the user-update route in redash/handlers/users.py when old_password is provided but user.verify_password(old_password) fails — the submitted current password does not match the stored hash. The update is rejected with 403 before any change is applied.

Source

Thrown at redash/handlers/users.py:218

        user = get_object_or_404(models.User.get_by_id_and_org, user_id, self.current_org)

        self.record_event({"action": "view", "object_id": user_id, "object_type": "user"})

        return user.to_dict(with_api_key=is_admin_or_owner(user_id))

    def post(self, user_id):  # noqa: C901
        require_admin_or_owner(user_id)
        user = models.User.get_by_id_and_org(user_id, self.current_org)

        req = request.get_json(True)

        params = project(req, ("email", "name", "password", "old_password", "group_ids"))

        if "password" in params and "old_password" not in params:
            abort(403, message="Must provide current password to update password.")

        if "old_password" in params and not user.verify_password(params["old_password"]):
            abort(403, message="Incorrect current password.")

        if "password" in params:
            user.hash_password(params.pop("password"))
            params.pop("old_password")

        if "group_ids" in params:
            if not self.current_user.has_permission("admin"):
                abort(403, message="Must be admin to change groups membership.")

            for group_id in params["group_ids"]:
                try:
                    models.Group.get_by_id_and_org(group_id, self.current_org)
                except NoResultFound:
                    abort(400, message="Group id {} is invalid.".format(group_id))

            if len(params["group_ids"]) == 0:
                params.pop("group_ids")

View on GitHub (pinned to ca79fe988d)

Solutions

1. Correct the old_password value to the user's actual current password.
2. If forgotten, use the password-reset email flow (or admin reset) instead of the update endpoint.
3. Keep credential sources in sync after any rotation; never cache passwords long-term.

Example fix

# before
client.post(f'/api/users/{uid}', json={'password': 'newsecret', 'old_password': 'wrong'})

# after
client.post(f'/api/users/{uid}', json={'password': 'newsecret', 'old_password': 'correct_current'})

if not user.verify_password(old_password):
    raise ValueError('current password mismatch — use reset flow')

try:
    client.post(f'/api/users/{uid}', json=payload)
except HTTPError as e:
    if e.response.status_code == 403 and 'Incorrect current password' in e.response.text:
        send_password_reset(user.email)
    else:
        raise

When it happens

Trigger: POST/PATCH updating the user with an incorrect old_password value (typo, outdated password, or password already changed elsewhere).

Common situations: Users typing an old password after a recent change; browser autofill submitting a stale password; automation holding a cached password that was rotated.

Related errors

• Must provide current password to update password.
• Invalid JWT token
• Username and Password required
• Azure AD Client ID, Client Secret, and Tenant ID are require
• MongoDB connection error

AI-assisted analysis of getredash/redash@ca79fe988d (2026-08-28). Data as JSON: /api/errors/2cae0fc8161c1df6. Report an issue: GitHub.