langflow-ai/langflow · error · HTTPException

Cannot change folder of a flow you do not own.

Error message

Cannot change folder of a flow you do not own.

What it means

HTTP 403 from _update_flow: the acting user is not the flow owner (actor_user_id != existing_flow.user_id) and the update payload attempts to change folder_id to a different value. Non-owner edits (possible when an authorization plugin grants cross-user write) are deliberately restricted from relocating the flow, because folder scope affects visibility and permissions.

Source

Thrown at src/backend/base/langflow/api/v1/flows_helpers.py:415

    shared edit allowed by a registered authorization plugin — ownership-
    bound state (folder, fs_path, ownership) must stay rooted at the owner,
    otherwise the write silently retargets folders/storage that belong to the
    actor. This mirrors the cross-user semantics already enforced by
    ``_patch_flow``.
    """
    await lock_flow_for_update(session, existing_flow)

    settings_service = get_settings_service()
    actor_user_id = current_user.id
    owner_user_id: UUID = existing_flow.user_id
    is_owner_edit = owner_user_id == actor_user_id

    # Non-owner edits cannot relocate the flow into folders or storage they
    # own, nor transfer ownership. Reject early so the failure is explicit
    # rather than corrupting scope downstream.
    if not is_owner_edit:
        if flow.folder_id is not None and flow.folder_id != existing_flow.folder_id:
            raise HTTPException(
                status_code=403,
                detail="Cannot change folder of a flow you do not own.",
            )
        if flow.fs_path is not None and flow.fs_path != existing_flow.fs_path:
            raise HTTPException(
                status_code=403,
                detail="Cannot change fs_path of a flow you do not own.",
            )
        if flow.user_id is not None and flow.user_id != owner_user_id:
            raise HTTPException(
                status_code=403,
                detail="Cannot transfer ownership of a flow you do not own.",
            )
        # ``a2a_enabled`` defaults to False (not None) on FlowCreate, so gate on
        # model_fields_set to block only an explicit, differing change.
        if "a2a_enabled" in flow.model_fields_set and flow.a2a_enabled != existing_flow.a2a_enabled:
            raise HTTPException(
                status_code=403,

View on GitHub (pinned to 976ec789d2)

Solutions

1. Omit folder_id from the payload — only the owner may relocate the flow.
2. Ask the owner (or a superuser) to perform the folder move.
3. If your plugin's policy intends to allow relocation, that must be an explicit product decision; the OSS guard blocks it regardless of plugin grants.

Example fix

# before (non-owner)
{"name": "renamed", "folder_id": "<other-folder>"}
# after
{"name": "renamed"}

if (!isOwner && body.folder_id && body.folder_id !== currentFlow.folder_id) delete body.folder_id;

When it happens

Trigger: PATCH/PUT on a flow you can edit via a plugin-granted permission but do not own, with a folder_id differing from the stored one.

Common situations: Team deployments with an RBAC plugin where an editor tries to move a colleague's flow into their own folder; automation scripts authenticated as a service account updating user flows while also passing folder_id.

Related errors

• Cannot change fs_path of a flow you do not own.
• Cannot change a2a_enabled of a flow you do not own.
• Cannot change a2a_card_overrides of a flow you do not own.
• Superuser required to administer role assignments.
• Superuser required to administer roles.

AI-assisted analysis of langflow-ai/langflow@976ec789d2 (2026-08-14). Data as JSON: /api/errors/f83009208c19430f. Report an issue: GitHub.