getredash/redash · error

Must provide current password to update password.

Error message

Must provide current password to update password.

What it means

Raised by the user-update route in redash/handlers/users.py when the request includes a new 'password' but not 'old_password'. Changing a user's password requires proving knowledge of the current password, so omitting it returns 403.

Source

Thrown at redash/handlers/users.py:215

    def get(self, user_id):
        require_permission_or_owner("list_users", user_id)
        user = get_object_or_404(models.User.get_by_id_and_org, user_id, self.current_org)

        self.record_event({"action": "view", "object_id": user_id, "object_type": "user"})

        return user.to_dict(with_api_key=is_admin_or_owner(user_id))

    def post(self, user_id):  # noqa: C901
        require_admin_or_owner(user_id)
        user = models.User.get_by_id_and_org(user_id, self.current_org)

        req = request.get_json(True)

        params = project(req, ("email", "name", "password", "old_password", "group_ids"))

        if "password" in params and "old_password" not in params:
            abort(403, message="Must provide current password to update password.")

        if "old_password" in params and not user.verify_password(params["old_password"]):
            abort(403, message="Incorrect current password.")

        if "password" in params:
            user.hash_password(params.pop("password"))
            params.pop("old_password")

        if "group_ids" in params:
            if not self.current_user.has_permission("admin"):
                abort(403, message="Must be admin to change groups membership.")

            for group_id in params["group_ids"]:
                try:
                    models.Group.get_by_id_and_org(group_id, self.current_org)
                except NoResultFound:
                    abort(400, message="Group id {} is invalid.".format(group_id))

View on GitHub (pinned to ca79fe988d)

Solutions

1. Include old_password alongside password in the request body.
2. If you are an admin resetting another user's password, use the admin reset_password endpoint instead.
3. Build UI forms that always require the current password when a new one is set.

Example fix

# before
client.post(f'/api/users/{uid}', json={'password': 'newsecret'})

# after
client.post(f'/api/users/{uid}', json={'password': 'newsecret', 'old_password': 'currentsecret'})

if 'password' in payload:
    assert 'old_password' in payload, 'old_password required to change password'

When it happens

Trigger: PATCH/POST to update a user with {"password": "newsecret"} and no old_password field (self-service profile update path).

Common situations: Profile-update forms that expose a password field without a current-password field; admin scripts trying to reset passwords via the profile endpoint instead of the admin reset route.

Related errors

• Incorrect current password.
• Bad email address.
• Group id {} is invalid.
• Missing `rows` field in `result` dict.
• Missing `columns` field in `result` dict.

AI-assisted analysis of getredash/redash@ca79fe988d (2026-08-28). Data as JSON: /api/errors/eb18c908402de05a. Report an issue: GitHub.