hashicorp/vault · error · Error

You do not have permissions to update your password. If you

Error message

You do not have permissions to update your password. If you think this is a mistake ask your administrator to update your policy.

What it means

Final guard in the reset-password route model (ui/app/routes/vault/cluster/access/reset-password.ts:38). The model fetches path capabilities for auth/<authMountPath>/users/<displayName>/password via the capabilities service; if the token cannot update that path (canUpdate false), it throws ERROR_NO_ACCESS directing the user to their administrator.

Source

Thrown at ui/app/routes/vault/cluster/access/reset-password.ts:38

  async model() {
    const { authMethodType, authMountPath, displayName } = this.auth.authData;
    // Password reset is only available on userpass type auth mounts
    if (authMethodType !== 'userpass') {
      throw new Error(ERROR_UNAVAILABLE);
    }

    // Both of these are necessary to build the reset password URL
    if (!authMountPath || !displayName) {
      throw new Error(ERROR_UNAVAILABLE);
    }

    const capabilities = await this.capabilities.fetchPathCapabilities(
      `auth/${authMountPath}/users/${displayName}/password`
    );

    // Throw an error if we know for certain the user doesn't have permission
    if (!capabilities.canUpdate) {
      throw new Error(ERROR_NO_ACCESS);
    }
    return {
      backend: authMountPath,
      username: displayName,
    };
  }
}

View on GitHub (pinned to 744b611b57)

Solutions

1. Ask an administrator to grant update on auth/<userpass-mount>/users/<name>/password in your policy
2. Verify what your token can do: vault token capabilities auth/userpass/users/<name>/password
3. Until granted, have an admin reset the password via vault write auth/userpass/users/<name>/password password=<new>

Example fix

// policy snippet that makes self-service reset work
path "auth/userpass/users/${identity.entity.aliases.auth_userpass_<mount>.name}/password" {
  capabilities = ["update"]
}

// Pre-check capabilities before showing the reset form
const caps = await this.capabilities.fetchPathCapabilities(`auth/${authMountPath}/users/${displayName}/password`);
if (!caps.canUpdate) {
  renderNoAccessNotice(); // policy guidance instead of a thrown route error
  return;
}

try {
  await this.router.transitionTo('vault.cluster.access.reset-password');
} catch (e) {
  if (e.message.includes('ask your administrator to update your policy')) {
    notifyUser('Your policy needs update on auth/<mount>/users/<name>/password for self-service reset');
  } else {
    throw e;
  }
}

When it happens

Trigger: The authenticated token's policy set lacks update on auth/userpass/users/<self>/password — e.g. a limited or default policy, a token minted by another system, or a policy path typo.

Common situations: Users whose ACLs deliberately exclude self-service password updates; policy written for the wrong mount path; tokens generated by orchestration tools with minimal capabilities.

Related errors

• Password reset is not available for the current user.

AI-assisted analysis of hashicorp/vault@744b611b57 (2026-08-15). Data as JSON: /api/errors/759d2777c22ecc84. Report an issue: GitHub.