passbolt/passbolt_api · error · Cake\Http\Exception\ForbiddenException

You are not allowed to update the permissions of this…

Error message

You are not allowed to update the permissions of this folder.

What it means

A ForbiddenException thrown by FoldersShareService::assertUserCanShare when a user attempts to share a folder (update its permissions) without being the folder's OWNER. The service checks the user's highest permission on the folder via UserHasPermissionService and requires exactly Permission::OWNER. Only owners may modify folder permissions, so any lesser permission (UPDATE or READ) results in this error.

Solutions

Log in or act as a user who is OWNER of the folder, or have the current owner perform the share operation.
Transfer ownership: as an owner, share the folder with the desired user with permission type OWNER, then retry the share as that user.
Verify the user's effective permission with the permission checks (e.g. GET /folders/{id} or permissions endpoints) before calling share.
If ownership data is wrong (e.g. the original owner left), an administrator can fix the permissions rows in the database or via the health check data repair tools.

Example fix

// before: share as a mere editor
POST /folders/{id}/share with uac of a non-owner user -> 403
// after: promote user to owner first (as existing owner)
POST /folders/{id}/share {"permissions":[{"aro":{"id":"<userId>"},"type":50}]} // 50 = OWNER
// then perform the share as that user

Defensive patterns

Strategy: try-catch

Validate before calling

// Before sharing, check ownership client-side
const perms = await api.get(`/permissions/folder/${folderId}`);
const mine = perms.find(p => p.user.id === currentUserId);
if (!mine || mine.type !== 15) {
  throw new Error('Only the folder OWNER can share this folder');
}

Try / catch

try {
  await foldersApi.share(folderId, permissions);
} catch (e) {
  if (e.response?.status === 403) {
    // user is not OWNER: request ownership or delegate to owner
  }
  throw e;
}

Prevention

Only call the share endpoint as the folder's owner (permission type 15).
Check the user's permission type before attempting share operations.
In UIs, disable share controls for non-owner users.
Transfer ownership explicitly when the owner role must change hands.

When it happens

Trigger: POST /folders/{folderId}/share (FoldersShareService::share) called by a user whose highest permission on the folder is UPDATE or READ, or who has no permission at all; also when sharing a folder the user can access only through inherited/group permissions but does not personally own.

Common situations: A folder owner shares a folder with a collaborator as EDITOR; the collaborator tries to re-share the folder or change permissions of nested content and gets a 403. Also seen in automated scripts using an API key/account that only has update rights, and after ownership was transferred away from the acting user.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/36ab2eee63c7cf20. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Folders/src/Service/Folders/FoldersShareService.php:174

        return $folder;
    }

    /**
     * Assert if the operator can share the given folder.
     *
     * @param \App\Utility\UserAccessControl $uac The operator
     * @param \Passbolt\Folders\Model\Entity\Folder $folder The folder to assert
     * @return void
     * @throws \Cake\Http\Exception\ForbiddenException If the user cannot share the folder
     */
    private function assertUserCanShare(UserAccessControl $uac, Folder $folder): void
    {
        $userId = $uac->getId();
        $isAllowed = $this->userHasPermissionService
            ->check(PermissionsTable::FOLDER_ACO, $folder->id, $userId, Permission::OWNER);
        if (!$isAllowed) {
            throw new ForbiddenException(__('You are not allowed to update the permissions of this folder.'));
        }
    }

    /**
     * Update a folder permissions
     *
     * @param \App\Utility\UserAccessControl $uac The operator
     * @param \Passbolt\Folders\Model\Entity\Folder $folder The target folder
     * @param array $changes The list of permissions changes
     * @return \App\Model\Dto\EntitiesChangesDto
     * @throws \App\Error\Exception\ValidationException If the permissions didn't validate
     * @throws \Exception If something went wrong
     */
    private function updatePermissions(UserAccessControl $uac, Folder $folder, array $changes): EntitiesChangesDto
    {
        $entitiesChanges = new EntitiesChangesDto();

        try {

View on GitHub (pinned to 31c1bbc10f)