passbolt/passbolt_api · error · Cake\Http\Exception\ForbiddenException

You are not allowed to update this folder.

Error message

You are not allowed to update this folder.

What it means

A ForbiddenException from FoldersUpdateService::getFolder, thrown when the user's highest permission on the folder exists but is below Permission::UPDATE (i.e. READ-only). FoldersUpdateService::update requires at least UPDATE permission to modify folder name or metadata.

Solutions

1. Ask the folder OWNER to share the folder with the user as UPDATE (type 7) or OWNER (type 15).
2. Perform the update as a user who already holds UPDATE or OWNER permission.
3. Refresh the client's permission data to confirm the current effective permission before retrying.
4. If permission inheritance from a parent folder should apply, verify the folder is in the expected shared hierarchy.

Example fix

// before: READ-only user renames folder -> 403
PUT /folders/{id} {"name":"new-name"}
// after: owner grants UPDATE first
POST /folders/{id}/share {"permissions":[{"aro":{"id":"<userId>"},"type":7}]}

const perms = await api.get(`/permissions/folder/${folderId}`);
const mine = perms.find(p => p.user.id === currentUserId);
if (!mine || mine.type < 7) {
  throw new Error('UPDATE permission required to modify this folder');
}

try {
  await foldersApi.update(folderId, data);
} catch (e) {
  if (e.response?.status === 403) {
    // request UPDATE/OWNER share from the owner before retrying
  }
  throw e;
}

When it happens

Trigger: PUT /folders/{folderId} by a user whose highest permission on the folder is READ (type < UPDATE); renaming or moving a folder shared as read-only; a formerly-UPDATE user downgraded to READ by the owner.

Common situations: Collaborators with viewer rights trying to rename shared folders; scripts using an account that was downgraded; UI state stale after an owner reduced permissions.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• You are not allowed to update the permissions of this…
• Access restricted to administrators.
• Only administrators are allowed to create/update MFA…
• Only administrators can add new users.
• Only administrators can view reports.

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/8edf8efdc05c51db. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltCe/Folders/src/Service/Folders/FoldersUpdateService.php:107

    /**
     * Retrieve the folder.
     *
     * @param \App\Utility\UserAccessControl $uac UserAccessControl updating the resource
     * @param string $folderId The folder identifier to retrieve.
     * @return \Passbolt\Folders\Model\Entity\Folder
     * @throws \Cake\Http\Exception\NotFoundException If the folder does not exist.
     */
    private function getFolder(UserAccessControl $uac, string $folderId): Folder
    {
        /** @var \App\Model\Entity\Permission|null $permission */
        $permission = $this->permissionsTable
            ->findHighestByAcoAndAro(PermissionsTable::FOLDER_ACO, $folderId, $uac->getId())
            ->first();

        if (empty($permission)) {
            throw new NotFoundException(__('The folder does not exist.'));
        } elseif ($permission->type < Permission::UPDATE) {
            throw new ForbiddenException(__('You are not allowed to update this folder.'));
        }

        return $this->foldersTable->get($folderId);
    }

    /**
     * Update folder meta.
     *
     * @param \App\Utility\UserAccessControl $uac The current user
     * @param \Passbolt\Folders\Model\Entity\Folder $folder The folder to update.
     * @param \Passbolt\Metadata\Model\Dto\MetadataFolderDto $folderDto The folder dto.
     * @return \Cake\Datasource\EntityInterface|\Passbolt\Folders\Model\Entity\Folder
     */
    private function updateFolderMeta(
        UserAccessControl $uac,
        Folder $folder,
        MetadataFolderDto $folderDto
    ): EntityInterface|Folder {

View on GitHub (pinned to 31c1bbc10f)