[Bug]: Access Denied Error on Appearance & Branding

[flor-digital]

Studio API version

2026.1.0

Steps to reproduce

Open Appearance & Branding (Side-Menu -> System -> Appearance & Branding) an try to save them. Not possible.

Use Settings-Store configuration:

pimcore_studio_backend:
    config_location:
        admin_settings:
            read_target:
                type: 'settings-store'
            write_target:
                type: 'settings-store'

Press save and get:

{
    "message": "Access Denied.",
    "detail": "#0 \/var\/www\/html\/vendor\/symfony\/security-http\/Firewall\/ExceptionListener.php(93): Symfony\\Component\\Security\\Http\\Firewall\\ExceptionListener-\u003EhandleAccessDeniedException()\n#1 \/var\/www\/html\/vendor\/symfony\/event-dispatcher\/Debug\/WrappedListener.php(115): Symfony\\Component\\Security\\Http\\Firewall\\ExceptionListener-\u003EonKernelException()\n#2 \/var\/www\/html\/vendor\/symfony\/event-dispatcher\/EventDispatcher.php(206): Symfony\\Component\\EventDispatcher\\Debug\\WrappedListener-\u003E__invoke()\n#3 \/var\/www\/html\/vendor\/symfony\/event-dispatcher\/EventDispatcher.php(56): Symfony\\Component\\EventDispatcher\\EventDispatcher-\u003EcallListeners()\n#4 \/var\/www\/html\/vendor\/symfony\/event-dispatcher\/Debug\/TraceableEventDispatcher.php(126): Symfony\\Component\\EventDispatcher\\EventDispatcher-\u003Edispatch()\n#5 \/var\/www\/html\/vendor\/symfony\/http-kernel\/HttpKernel.php(241): Symfony\\Component\\EventDispatcher\\Debug\\TraceableEventDispatcher-\u003Edispatch()\n#6 \/var\/www\/html\/vendor\/symfony\/http-kernel\/HttpKernel.php(91): Symfony\\Component\\HttpKernel\\HttpKernel-\u003EhandleThrowable()\n#7 \/var\/www\/html\/vendor\/symfony\/http-kernel\/Kernel.php(193): Symfony\\Component\\HttpKernel\\HttpKernel-\u003Ehandle()\n#8 \/var\/www\/html\/vendor\/symfony\/runtime\/Runner\/Symfony\/HttpKernelRunner.php(35): Symfony\\Component\\HttpKernel\\Kernel-\u003Ehandle()\n#9 \/var\/www\/html\/vendor\/autoload_runtime.php(32): Symfony\\Component\\Runtime\\Runner\\Symfony\\HttpKernelRunner-\u003Erun()\n#10 \/var\/www\/html\/public\/index.php(19): require_once(\u0027...\u0027)\n#11 {main}"
}

Use Symfony-Config to store:

pimcore_studio_backend:
    config_location:
        admin_settings:
            read_target:
                type: 'symfony-config'
                options:
                    directory: '/var/www/html/var/config/admin_settings/'
            write_target:
                type: 'symfony-config'
                options:
                    directory: '/var/www/html/var/config/admin_settings/'

It is not possible to save in this mode.

Only possibility is to configure in config.yaml

Actual Behavior

It is not possible to save admin settings from backend.

Expected Behavior

It is possible to save admin settings from backend.

[lukmzig]

@flor-digital thank you for reporting this issue, I was however not able to reproduce this. The access denied suggest 2 possible issues:

1. The according permission (system_appearance_settings) is missing in your system, it should have been added by this migration: https://github.com/pimcore/pimcore/blob/2026.1/bundles/CoreBundle/src/Migrations/Version20230405162853.php Can you verify if it was added?
2. The user who is performing the update does not have this permission assigned

Can you try and reproduce your issue on our public pimcore demo?

[martineiber]

Closing due to inactivity. Feel free to reopen if the issue is still relevant.