n8n-io/n8n · error · ForbiddenError

Cannot change your own global role

Error message

Cannot change your own global role

What it means

Returned by PATCH /users/:id/role when req.user.id === id — the caller is attempting to change their own global role. This is a privilege-escalation guard; the message is the CANNOT_CHANGE_OWN_ROLE constant from UsersController.ERROR_MESSAGES.CHANGE_ROLE. HTTP 403. Fires after the provisioning check, before target-user lookup.

Source

Thrown at packages/cli/src/controllers/users.controller.ts:357

	@GlobalScope('user:changeRole')
	@Licensed('feat:advancedPermissions')
	async changeGlobalRole(
		req: AuthenticatedRequest,
		_: Response,
		@Body payload: RoleChangeRequestDto,
		@Param('id') id: string,
	) {
		if (await this.provisioningService.isInstanceRoleManaged()) {
			throw new ForbiddenError(
				'Instance roles are managed automatically and cannot be changed manually',
			);
		}

		const { NO_ADMIN_ON_OWNER, NO_USER, NO_OWNER_ON_OWNER, CANNOT_CHANGE_OWN_ROLE } =
			UsersController.ERROR_MESSAGES.CHANGE_ROLE;

		if (req.user.id === id) {
			throw new ForbiddenError(CANNOT_CHANGE_OWN_ROLE);
		}

		const targetUser = await this.userRepository.findOne({
			where: { id },
			relations: ['role'],
		});
		if (targetUser === null) {
			throw new NotFoundError(NO_USER);
		}

		if (
			req.user.role.slug === GLOBAL_ADMIN_ROLE.slug &&
			targetUser.role.slug === GLOBAL_OWNER_ROLE.slug
		) {
			throw new ForbiddenError(NO_ADMIN_ON_OWNER);
		}

		if (

View on GitHub (pinned to 5ac6606e81)

Solutions

1. Have a different authorized user (or the provisioning system) change the role.
2. Exclude the caller's id from any role-batch operation.
3. Hide the role-change affordance on the current user's own row in the UI.

function assertNotSelf(targetId: string, currentUserId: string) {
  if (targetId === currentUserId) {
    throw new Error('Cannot change your own role; ask another authorized user');
  }
}

When it happens

Trigger: A user calling PATCH /users/<their-own-id>/role with a RoleChangeRequestDto to elevate or change their own role.

Common situations: Admin testing the endpoint on themselves; UI accidentally letting the current user pick themselves in the role-change dialog; automated role-sync job that includes the operator.

Related errors

• Admin cannot change role on global owner
• Owner cannot change role on global owner
• Admin cannot reset password of global owner
• Instance owner cannot be deleted.
• Instance roles are managed automatically and cannot be chang

AI-assisted analysis of n8n-io/n8n@5ac6606e81 (2026-08-12). Data as JSON: /api/errors/7396590d9f1b89bb. Report an issue: GitHub.