# Access Denied error when trying to customize some site texts
**URL:** https://meta.discourse.org/t/access-denied-error-when-trying-to-customize-some-site-texts/377902
**Category:** Bug
**Created:** [February 5, 2025, 4:41am UTC](https://meta.discourse.org/t/access-denied-error-when-trying-to-customize-some-site-texts/377902 "2025-02-05T04:41:08Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@jordan-violet](https://meta.discourse.org/u/jordan-violet)
#### Post date: [February 5, 2025, 4:41am UTC](https://meta.discourse.org/t/access-denied-error-when-trying-to-customize-some-site-texts/377902/1 "2025-02-05T04:41:08Z")
Also, since I started down this path, I now get this when I attempt to edit certain site texts:
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [August 8, 2025, 3:39pm UTC](https://meta.discourse.org/t/access-denied-error-when-trying-to-customize-some-site-texts/377902/2 "2025-08-08T15:39:38Z")
Good catch and sorry for the delay responding! Next time post a #Contribute > Bug topic to get eyeballs on it sooner!
I am able to replicate this here on meta and on my personal site using the URL in your screenshot.
`/admin/customize/site_texts?q=confirm%20old`
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [August 8, 2025, 3:48pm UTC](https://meta.discourse.org/t/access-denied-error-when-trying-to-customize-some-site-texts/377902/4 "2025-08-08T15:48:58Z")
> [@tobiaseigen](#):
>
> `/admin/customize/site_texts?q=confirm%20old`
I can’t remember that the link ever worked without a locale parameter 🤔
`/admin/customize/site_texts?q=confirm%20old&locale=en` works fine for me.
And I think the fact that you cannot customize the “confirm old email” text is intended. It’s an email only send to staff
> [@Discourse hacked via sophisticated social engineering](https://meta.discourse.org/t/discourse-hacked-via-sophisticated-social-engineering/87905/2):
>
> However
>
> > 🛑 the hacker **edited the staff old email confirmation template** , so that it included the “yes, validate this old email change” URL and then once this was sent to the old email address and **clicked** , the hacker suddenly had permission to change the old email address to a new one he controls ☹
>
> Bear in mind _this is a very sophisticated, in-depth attack_, and it could have been stopped many levels above with practices that are already strongly recommended, just read through the lightbulb callouts 💡 above.
>
> Still, we believe strongly in being _safe by default_ at Discourse, and we think there is more we can do after closely analyzing this story. As a result, we [just implemented a change](https://github.com/discourse/discourse/commit/9f422c93f67f156c3216a57cdf1afc0c5fc94e28) such that _nobody_, not even an admin, can modify that particular email template. We believe it is a rare case, but worth addressing, because:
>
> - this particular email template is _only_ ever sent to staff on email change, as both the _old_ and new email addresses must be confirmed. For a regular user only the _new_ email address needs to be confirmed. So changing this template for cosmetic design reasons would only be seen by staff, never by regular users, and is thus unimportant.
> - the risk of allowing admins to change this template is too high, as illustrated by the above REAL WORLD story which actually happened, and was the critical step that allowed the attacker access to the complete Discourse database.
---
### Author:  [@tobiaseigen](https://meta.discourse.org/u/tobiaseigen)
#### Post date: [August 8, 2025, 3:53pm UTC](https://meta.discourse.org/t/access-denied-error-when-trying-to-customize-some-site-texts/377902/5 "2025-08-08T15:53:55Z")
So is this a #Contribute > UX bug too? It shouldn’t be possible to land on a cryptic “Access Denied” page when searching for site texts and then editing them.
---
### Author:  [@RGJ](https://meta.discourse.org/u/RGJ)
#### Post date: [August 8, 2025, 7:14pm UTC](https://meta.discourse.org/t/access-denied-error-when-trying-to-customize-some-site-texts/377902/7 "2025-08-08T19:14:31Z")
It looks like the custom message is not getting through to the user interface?
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [August 9, 2025, 12:27pm UTC](https://meta.discourse.org/t/access-denied-error-when-trying-to-customize-some-site-texts/377902/8 "2025-08-09T12:27:26Z")
> [@Moin](#):
>
> It’s an email only send to staff
It was brought to my attention that since Codinghorror’s post, the `require change email confirmation` setting has been added. This means the message can now be sent to more than just staff.
The original reason for blocking edits to this template was valid at the time, but today the protection it offers is different. An attacker who knows an admin password can simply:
1. Use the password to set up two-factor authentication for that account.
2. Create a new account.
3. Use the 2FA code to grant the new account admin rights.
From there, they can send the backup to their own email address without needing an admin to click a link to confirm an address change.
So the question is: does blocking edits to this template still make sense? It is now sent to regular users and it does no longer protect the download of a backup.
Also, [Data Explorer](https://meta.discourse.org/t/32566?silent=true) is now always installed and can be used to access the database.
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [December 24, 2025, 12:56pm UTC](https://meta.discourse.org/t/access-denied-error-when-trying-to-customize-some-site-texts/377902/9 "2025-12-24T12:56:12Z")
> [@Moin](#):
>
> And I think the fact that you cannot customize the “confirm old email” text is intended.
It is indeed and the solution is to not show them when filtering/searching for them
[https://github.com/discourse/discourse/pull/36857](https://github.com/discourse/discourse/pull/36857)
---
### Author:  [@Moin](https://meta.discourse.org/u/Moin)
#### Post date: [December 24, 2025, 7:18pm UTC](https://meta.discourse.org/t/access-denied-error-when-trying-to-customize-some-site-texts/377902/11 "2025-12-24T19:18:23Z")
Isn’t finding nothing more confusing than seeing the error message that should be shown? And what about the fact that this is no longer only sent to staff and is no longer required for downloading a backup?
---
### Author:  [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [December 25, 2025, 7:00am UTC](https://meta.discourse.org/t/access-denied-error-when-trying-to-customize-some-site-texts/377902/12 "2025-12-25T07:00:02Z")
This topic was automatically closed after 14 hours. New replies are no longer allowed.