gitroomhq/postiz-app · error · Error

You do not have permission to delete this user

Error message

You do not have permission to delete this user

What it means

Thrown by OrganizationService.deleteTeamMember when the caller's role in the organization is lower than the role of the user they are trying to remove. Roles are ranked USER=0, ADMIN=1, SUPERADMIN/OWNER=2. A caller may only delete members at or below their own level.

Source

Thrown at libraries/nestjs-libraries/src/database/prisma/organizations/organization.service.ts:175

    return { added: true };
  }

  async deleteTeamMember(org: Organization, userId: string) {
    const userOrgs = await this._organizationRepository.getOrgsByUserId(userId);
    const findOrgToDelete = userOrgs.find((orgUser) => orgUser.id === org.id);
    if (!findOrgToDelete) {
      throw new Error('User is not part of this organization');
    }

    // @ts-ignore
    const myRole = org.users[0].role;
    const userRole = findOrgToDelete.users[0].role;
    const myLevel = myRole === 'USER' ? 0 : myRole === 'ADMIN' ? 1 : 2;
    const userLevel = userRole === 'USER' ? 0 : userRole === 'ADMIN' ? 1 : 2;

    if (myLevel < userLevel) {
      throw new Error('You do not have permission to delete this user');
    }

    return this._organizationRepository.deleteTeamMember(org.id, userId);
  }

  disableOrEnableNonSuperAdminUsers(orgId: string, disable: boolean) {
    return this._organizationRepository.disableOrEnableNonSuperAdminUsers(
      orgId,
      disable
    );
  }

  getShortlinkPreference(orgId: string) {
    return this._organizationRepository.getShortlinkPreference(orgId);
  }

  updateShortlinkPreference(orgId: string, shortlink: ShortLinkPreference) {
    return this._organizationRepository.updateShortlinkPreference(

View on GitHub (pinned to 0f1647f749)

Solutions

1. Hide/disable the delete action in the UI for members whose role exceeds the current user's role
2. Ask a SUPERADMIN of the organization to perform the deletion
3. Demote the target user's role first (if you have permission), then delete them
4. If the hierarchy rule is wrong for your deployment, adjust the myLevel/userLevel comparison in organization.service.ts:175

Example fix

// before
await organizationService.deleteTeamMember(orgId, targetUserId);
// after
const myLevel = role === 'USER' ? 0 : role === 'ADMIN' ? 1 : 2;
const targetLevel = targetRole === 'USER' ? 0 : targetRole === 'ADMIN' ? 1 : 2;
if (myLevel >= targetLevel) {
  await organizationService.deleteTeamMember(orgId, targetUserId);
}

const level = (r) => (r === 'USER' ? 0 : r === 'ADMIN' ? 1 : 2);
const canDelete = myRole && targetRole && level(myRole) >= level(targetRole);
if (canDelete) await api.deleteTeamMember(orgId, targetUserId);

When it happens

Trigger: Calling DELETE /organization/:orgId/user/:userId (deleteTeamMember) where the authenticated user is a USER or ADMIN and the target member holds a strictly higher role (e.g. an ADMIN attempting to delete a SUPERADMIN, or a USER attempting to delete an ADMIN).

Common situations: Team management UI allowing admins to see but not delete owners; orgs seeded with multiple SUPERADMINs after plan changes; frontend not filtering the member list by deletable roles.

Related errors

• Unauthorized
• Unauthorized
• Unauthorized
• Subscription required: section ${item[1]}, action ${item[0]}
• Invalid redirect_uri

AI-assisted analysis of gitroomhq/postiz-app@0f1647f749 (2026-08-27). Data as JSON: /api/errors/6b7e3c2ec74874d2. Report an issue: GitHub.