Skip to content

Serious RBAC countDraftRelations 403 error when specific permissions are selected #25965

@marcosrego-web

Description

@marcosrego-web

Node Version

22.22.2

Package Manager

yarn

Package Manager Version

1.22.2

Strapi Version

5.42.0

Operating System

Linux (Other)

Database

PostgreSQL

Javascript or Typescript

Typescript

Reproduction URL

No response

Bug Description

When opening any entry as a user with a specific role the following error appears "An error occurred while fetching draft relations on this document.".

The log shows:
(...)/(documentId)/actions/countDraftRelations?locale=en 403 (Forbidden).

The users can save and publish the entry anyway but I'm not sure if there are side effects with the forbidden error.
The error keeps appearing every time the user opens, saves, publishes, which is really annoying and looks serious to my clients with those user roles.

I was on Strapi 5.42.0 but I had to rollback to 5.33.4. I noticed this error is happening since version 5.34.0.
The same issue occurs in both localhost with sqlite and staging with postgresql.

Investigating it deeper, I noticed if I uncheck the rules "Same as creator" and "Same role" from all the permissions, those errors don't appear.
It doesn't matter if it's read, publish or creator, if one of those permissions has "same as creator" or "same role" selected those errors will appear.

But I need more than just Read, create, etc for those clients, the goal has always been to only see posts when sharing the same role as creator.

Steps to Reproduce

1- Create a user role with permissions to read, create and publish a Collection type.
2- Set some of the permissions to Can (...) when is Creator and Can (...) when has same role as creator
3- Associate that role to a user.
4- Login as that user.
5- Create an entry.
6- Save or Publish, and see the error starting to appear every time the entry is opened/save/published

Expected Behavior

There should be no 403 error as Forbidden since the user is the creator and shares same role as creator as set on the user role permissions. The error "An error occurred while fetching draft relations on this document.". should not appear.

Logs

_(...)/(documentId)/actions/countDraftRelations?locale=en 403 (Forbidden)._

Code Snippets

No response

Media

No response

Additional information

No response

Confirmation Checklist

Metadata

Metadata

Assignees

No one assigned

    Labels

    flag: regressionflagging a regression from a releaseissue: bugIssue reporting a bugseverity: highIf it breaks the basic use of the productsource: rbacstatus: confirmedConfirmed by a Strapi Team member or multiple community membersversion: 5Issue is present in Strapi 5

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions