hyperledger/fabric · error

tx creator does not have read access permission on privateda

Error message

tx creator does not have read access permission on privatedata in chaincodeName:%s collectionName: %s

What it means

errorIfCreatorHasNoReadPermission enforces private data collection access control: the transaction creator must have read permission on the collection per its memberOrgsPolicy. This error means the tx creator's organization is not in the collection's read (memberOrgsPolicy) policy for the given chaincode/collection, so GetState-style private data reads are denied.

Source

Thrown at core/chaincode/handler.go:638

func (h *Handler) checkPurgePrivateDataCap(channelId string) error {
	ac, exists := h.AppConfig.GetApplicationConfig(channelId)
	if !exists {
		return errors.Errorf("application config does not exist for %s", channelId)
	}

	if !ac.Capabilities().PurgePvtData() {
		return errors.New("purge private data is not enabled, channel application capability of V2_5 or later is required")
	}
	return nil
}

func errorIfCreatorHasNoReadPermission(chaincodeName, collection string, txContext *TransactionContext) error {
	rwPermission, err := getReadWritePermission(chaincodeName, collection, txContext)
	if err != nil {
		return err
	}
	if !rwPermission.read {
		return errors.Errorf("tx creator does not have read access permission on privatedata in chaincodeName:%s collectionName: %s",
			chaincodeName, collection)
	}
	return nil
}

func errorIfCreatorHasNoWritePermission(chaincodeName, collection string, txContext *TransactionContext) error {
	rwPermission, err := getReadWritePermission(chaincodeName, collection, txContext)
	if err != nil {
		return err
	}
	if !rwPermission.write {
		return errors.Errorf("tx creator does not have write access permission on privatedata in chaincodeName:%s collectionName: %s",
			chaincodeName, collection)
	}
	return nil
}

func getReadWritePermission(chaincodeName, collection string, txContext *TransactionContext) (*readWritePermission, error) {

View on GitHub (pinned to 2736b63f8f)

Solutions

1. Update the collection definition (collections_config.json) so memberOrgsPolicy includes the org needing read access, and re-commit with the chaincode upgrade
2. Issue the read from a client/transactor whose org is listed in the collection's read policy
3. Verify the client's MSP identity matches the expected org
4. If reads shouldn't be possible, catch and handle the denied access in chaincode instead of failing the tx unexpectedly

Example fix

// before: collections_config.json
"memberOrgsPolicy": { "type": "SIGNATURE", "rule": "OR('Org1MSP.peer')" }
// after: grant Org2 read
"memberOrgsPolicy": { "type": "SIGNATURE", "rule": "OR('Org1MSP.peer', 'Org2MSP.peer')" }

// review collections_config.json read policy before deploying:
// memberOrgsPolicy must contain every org that will read the collection

val, err := stub.GetPrivateData("coll1", key)
if err != nil && strings.Contains(err.Error(), "does not have read access permission") {
    return shim.Error("org not authorized to read this collection; check memberOrgsPolicy")
}
if err != nil { return shim.Error(err.Error()) }

When it happens

Trigger: Chaincode calls GetPrivateData / GetPrivateDataMetadata / GetPrivateDataByRange / GetPrivateDataQueryResult on a collection whose memberOrgsPolicy read config does not include the tx creator's org; reading from a collection during endorsement by an org outside the read list.

Common situations: Orgs added to a collection's peers list but not to its read policy; developers testing cross-org reads on restricted collections; collection definitions copied from templates without adjusting requiredPeerCount/memberOrgsPolicy; wrong org MSP configured for the submitting client.

Related errors

• tx creator does not have write access permission on privated
• collection configuration is empty
• no collection config for chaincode %#v
• unknown collection configuration type
• collection-name: %s -- found duplicate collection configurat

AI-assisted analysis of hyperledger/fabric@2736b63f8f (2026-09-04). Data as JSON: /api/errors/ac0344b8f4d7ed87. Report an issue: GitHub.