nextcloud/server · warning · Sabre\DAV\Exception\Forbidden

Setting ACL is not supported on this node

Error message

Setting ACL is not supported on this node

What it means

AppCalendar exposes an app-registered OCP\Calendar\ICalendar over CalDAV. Sabre's DAVACL plugin routes an HTTP ACL request to setACL(), but permissions for such calendars derive from the app's getPermissions()/getACL(), so writing ACLs is refused with Sabre\DAV\Exception\Forbidden (HTTP 403).

Source

Thrown at apps/dav/lib/CalDAV/AppCalendar/AppCalendar.php:86

			[
				'privilege' => '{DAV:}write-properties',
				'principal' => $this->getOwner(),
				'protected' => true,
			]
		];
		if ($this->getPermissions() & Constants::PERMISSION_CREATE) {
			$acl[] = [
				'privilege' => '{DAV:}write',
				'principal' => $this->getOwner(),
				'protected' => true,
			];
		}
		return $acl;
	}

	#[\Override]
	public function setACL(array $acl): void {
		throw new Forbidden('Setting ACL is not supported on this node');
	}

	#[\Override]
	public function getSupportedPrivilegeSet(): ?array {
		// Use the default one
		return null;
	}

	#[\Override]
	public function getLastModified(): ?int {
		// unknown
		return null;
	}

	#[\Override]
	public function delete(): void {
		// No method for deleting a calendar in OCP\Calendar\ICalendar
		throw new Forbidden('Deleting an entry is not implemented');

View on GitHub (pinned to ecdeb153ff)

Solutions

  1. Manage sharing/permissions in the providing app's own UI or API, not via CalDAV ACL
  2. Treat 403 on ACL for app calendars as 'permissions fixed by source app' and skip the request in the client
  3. App developers: document that permissions come from getPermissions() and cannot be changed over CalDAV
Defensive patterns

Strategy: fallback

Validate before calling

// Skip ACL writes on app-backed calendars
if ($node instanceof \OCA\DAV\CalDAV\AppCalendar\AppCalendar) {
    return; // permissions are managed by the source app
}

Type guard

function isAppManagedCalendar(Sabre\DAV\INode $node): bool {
    return $node instanceof \OCA\DAV\CalDAV\AppCalendar\AppCalendar;
}

Try / catch

try {
    $node->setACL($acl);
} catch (Sabre\DAV\Exception\Forbidden $e) {
    // ACL is owned by the source app; skip and continue the sync
}

Prevention

When it happens

Trigger: A CalDAV client issuing an ACL method request (granting/modifying ACEs) against an app-provided calendar collection, e.g. calendars/<user>/<appid-<uri>>/

Common situations: Third-party calendar apps that appear in CalDAV clients; clients like Thunderbird or Apple Calendar attempting permission management on app-backed or shared calendars.

Related errors

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/ffd6e16f23070be5. Report an issue: GitHub.