overleaf/overleaf · error · ForbiddenError

confirm-email-wrong-user

confirm-email-wrong-user

Error message

We can’t confirm this email. You must be logged in with the Overleaf account that requested the new secondary email.

What it means

Error branch in confirm: UserEmailsConfirmationHandler.confirmEmailFromToken threw Errors.ForbiddenError, meaning the confirmation token is valid but the currently logged-in account is not the one that requested the secondary email; rejected with 403 key 'confirm-email-wrong-user'.

Source

Thrown at services/web/app/src/Features/User/UserEmailsController.mjs:653

  primaryEmailCheck: expressify(primaryEmailCheck),

  showConfirm: expressify(showConfirm),

  confirm(req, res, next) {
    const { token } = req.body
    if (!token) {
      return res.status(422).json({
        message: req.i18n.translate('confirmation_link_broken'),
      })
    }
    UserEmailsConfirmationHandler.confirmEmailFromToken(
      req,
      token,
      function (error, userData) {
        if (error) {
          if (error instanceof Errors.ForbiddenError) {
            res.status(403).json({
              message: {
                key: 'confirm-email-wrong-user',
                text: `We can’t confirm this email. You must be logged in with the Overleaf account that requested the new secondary email.`,
              },
            })
          } else if (error instanceof Errors.NotFoundError) {
            res.status(404).json({
              message: req.i18n.translate('confirmation_token_invalid'),
            })
          } else {
            next(error)
          }
        } else {
          const { userId, email } = userData
          const tokenPrefix = token.substring(0, AUDIT_LOG_TOKEN_PREFIX_LENGTH)
          UserAuditLogHandler.addEntry(
            userId,
            'confirm-email',

View on GitHub (pinned to 28ad3b03b7)

Solutions

1. Log in with the account that added the secondary email, then confirm
2. Request the confirmation from the correct account so the token matches

When it happens

Trigger: Thrown at services/web/app/src/Features/User/UserEmailsController.mjs:653 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of overleaf/overleaf@28ad3b03b7 (2026-09-03). Data as JSON: /api/errors/98b49685d7f2f37e. Report an issue: GitHub.