Alpha user can edit properties of another user's chart but not save in 6.0.0

[sfirke]

Bug description

• Gamma user creates a chart.
• Alpha user goes to edit that chart's properties
• Superset allows them them to see the edit modal, where it looks like they could even change the chart owner - but then when they hit save it says they they don't have permission

Not having permission is correct - but then it shouldn't allow them to click into the edit modal.

Screenshots/recordings

Sorry no screenshot or recording now, I observed this while troubleshooting a different issue for one of my users.

Superset version

6.0.0

Python version

I don't know

Node version

I don't know

Browser

Firefox

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

This is a known frontend/backend permission inconsistency. The root cause is:

1. Frontend allows modal access - The "Edit chart properties" menu item is shown based on whether the chart exists, without checking ownership.

2. Backend enforces ownership - The UpdateChartCommand correctly checks that only admins and chart owners can save changes, rejecting non-owners with a 403 Forbidden.

The Alpha role includes can write on Chart permission by default, which is enough to display the modal—but write permission alone doesn't grant the ability to overwrite another user's chart.

There's an unmerged PR #32995 that documents this exact bug and proposes a fix. Interestingly, a proper pattern already exists elsewhere in the codebase: ExploreChartHeader checks both canOverwrite and ownership before allowing chart title edits. This same pattern should be applied to the Properties modal.

To reply, just mention @dosu.

---

Share context across your team and agents. Try Dosu.