nextcloud/server · warning · Sabre\DAV\Exception\Forbidden

Permission denied to create collections

Error message

Permission denied to create collections

What it means

RootCollection::createDirectory() refuses MKCOL below the comments root with Forbidden (HTTP 403). The comment tree structure — entity types and per-object collections — is managed by the server and cannot be extended by clients creating collections.

Source

Thrown at apps/dav/lib/Comments/RootCollection.php:90

	 * @param string $name Name of the file
	 * @param resource|string $data Initial payload
	 * @return null|string
	 * @throws Forbidden
	 */
	#[\Override]
	public function createFile($name, $data = null) {
		throw new Forbidden('Cannot create comments by id');
	}

	/**
	 * Creates a new subdirectory
	 *
	 * @param string $name
	 * @throws Forbidden
	 */
	#[\Override]
	public function createDirectory($name) {
		throw new Forbidden('Permission denied to create collections');
	}

	/**
	 * Returns a specific child node, referenced by its name
	 *
	 * This method must throw Sabre\DAV\Exception\NotFound if the node does not
	 * exist.
	 *
	 * @param string $name
	 * @return \Sabre\DAV\INode
	 * @throws NotFound
	 */
	#[\Override]
	public function getChild($name) {
		$this->initCollections();
		if (isset($this->entityTypeCollections[$name])) {
			return $this->entityTypeCollections[$name];
		}

View on GitHub (pinned to ecdeb153ff)

Solutions

1. Remove the MKCOL step: collections appear automatically once apps register entity types via CommentsEntityEvent.
2. For custom commentable objects, register an entity type in a server-side app instead of creating collections over DAV.
3. Point WebDAV mount and sync tools at the files tree, not the comments tree.

When it happens

Trigger: MKCOL /remote.php/dav/comments/<name> attempting to create a custom collection, often as a workaround after receiving a 404 for an unregistered entity type.

Common situations: WebDAV clients that auto-create folders before uploading; users manually attempting to 'fix' a missing collection; scripts replicating a folder workflow onto the comments tree.

Related errors

• Only authors are allowed to edit their comment.
• Cannot create comments by id
• Permission denied to delete this collection
• Permission denied to rename this collection
• Permission denied to create a directory in the trashbin

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/2f3c17c31d0f77e4. Report an issue: GitHub.