Content created as Admin becomes invisible after role demotion to "own"-scoped role, joint_permissions.owner_id set to NULL after regenerate-permissions #6097

New issue

Open

opened 2026-04-13 15:36:46 +00:00 by bedeberger · 1 comment

bedeberger commented

2026-04-13 15:36:46 +00:00

(Migrated from github.com)

Describe the Bug

When a user who was previously an Admin gets demoted to a non-admin role with "own"-scoped asset permissions (e.g. "View own books"), the content they created as Admin becomes invisible to them. Running php artisan bookstack:regenerate-permissions does not fix the issue.
Root cause: After regenerate-permissions, the joint_permissions table has owner_id = NULL for non-admin roles, even though entities.owned_by and entities.created_by are correctly set to the user's ID. BookStack's permission query grants access via owner_id = <user_id> — with NULL, access is denied despite the user being the owner.

Steps to Reproduce

User A has the Admin role and creates a book (e.g. entities.owned_by = 1, created_by = 1)
A new admin account is created
User A's Admin role is removed and replaced with a non-admin role (e.g. "Editor") with "View own" book permission
User A can no longer see their own book
Run php artisan bookstack:regenerate-permissions → does not fix the issue
Run php artisan cache:clear → does not fix the issue

Expected Behaviour

regenerate-permissions should populate joint_permissions.owner_id from entities.owned_by for all roles, including non-admin roles with "own"-scoped permissions.

Screenshots or Additional Context

Workaround
Creating a dedicated role with "View all" scope for the affected user restores visibility, but is not a clean solution for multi-user setups with strict "own"-scoped isolation.

Browser Details

No response

Exact BookStack Version

v26.03.3

### Describe the Bug When a user who was previously an Admin gets demoted to a non-admin role with "own"-scoped asset permissions (e.g. "View own books"), the content they created as Admin becomes invisible to them. Running php artisan bookstack:regenerate-permissions does not fix the issue. Root cause: After regenerate-permissions, the joint_permissions table has owner_id = NULL for non-admin roles, even though entities.owned_by and entities.created_by are correctly set to the user's ID. BookStack's permission query grants access via owner_id = <user_id> — with NULL, access is denied despite the user being the owner. ### Steps to Reproduce 1. User A has the Admin role and creates a book (e.g. entities.owned_by = 1, created_by = 1) 2. A new admin account is created 3. User A's Admin role is removed and replaced with a non-admin role (e.g. "Editor") with "View own" book permission 4. User A can no longer see their own book 5. Run php artisan bookstack:regenerate-permissions → does not fix the issue 6. Run php artisan cache:clear → does not fix the issue ### Expected Behaviour regenerate-permissions should populate joint_permissions.owner_id from entities.owned_by for all roles, including non-admin roles with "own"-scoped permissions. ### Screenshots or Additional Context Workaround Creating a dedicated role with "View all" scope for the affected user restores visibility, but is not a clean solution for multi-user setups with strict "own"-scoped isolation. ### Browser Details _No response_ ### Exact BookStack Version v26.03.3

ssddanbrown commented

2026-04-14 11:29:17 +00:00

(Migrated from github.com)

Hi @bedeberger,
Could I just check, for the scenario in question, have any permission changes be made to the book itself?

Any role permission overrides set on the book?
What does the "Everyone Else" row show in the book permissions?

Hi @bedeberger, Could I just check, for the scenario in question, have any permission changes be made to the book itself? - Any role permission overrides set on the book? - What does the "Everyone Else" row show in the book permissions?

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

bookstack/bookstack#6097

No description provided.

Rows
Columns