FORBIDDEN error when editing relational field (e.g., file) in right side panel
- Dominant language
- TypeScript
- Stars
- 37.9k
- Forks
- 4.9k
- Avg merge
- 3d 21h
- Merged PRs (30d)
- 36
Description
### Describe the Bug
# Description:
When attempting to edit a relational field in a collection (a file in my case), I encounter the following error:
`[FORBIDDEN] You don't have permission to access this.`
````
{
"errors": [
{
"message": "You don't have permission to access this.",
"extensions": {
"code": "FORBIDDEN"
}
}
]
}
````
After this error, the side panel opens, and I am still able to edit the relational field.
# Possible Cause:
I suspect this issue occurs because Directus tries to fetch all fields of the relational item, including user_created. If the relational item was created by an admin user, this means a non-admin user would attempt to access admin user information, which is restricted and triggers the FORBIDDEN error.
## overview of directus logs :
```
[11:32:39] GET /files/f2a69922-fd5f-4d62-986d-1d4273509b33?fields=* 304 57ms
[11:32:39] GET /users/000487d1-2ee2-40ef-8cee-0ee1028d6578?fields[]=avatar.id&fields[]=avatar.type&fields[]=avatar.title&fields[]=first_name&fields[]=last_name&fields[]=id 403 51ms
```
However, in my application, any non-admin user should be allowed to read and modify relational fields, regardless of whether the item was created by an admin.
Plus, when opening the item directly in the files library, this doesn’t happen.
### To Reproduce
1. Create two users:
- Admin user: Full admin permissions.
- Non-admin user: Full access to directus_files and directus_folders.
2. With the admin user, create an item in a collection containing a file field. Add a file to this entry.
3. With the non-admin user, try to edit the item and click on the arrow icon in the relational field. This will:
- Show the FORBIDDEN error message.
- Then open the side panel, allowing the relational item to be edited anyway.


### Directus Version
11.3.2
### Hosting Strategy
Self-Hosted (Custom)
### Database
MySQL
Contributor guide
Assessment
This issue has not been assessed yet.