Portal users cannot access emails

[jacao]

Hello,

I'm facing an issue where a portal user cannot access email messages. The permissions are set to the Account level. The messages are visible in the History panel, but clicking on them results in a 403 error. However, if the portal user (via the linked Contact) is the sender of the email, the message content can be displayed without issues.

When I raise the portal user’s permission level to All, they are able to view all messages. When I lower it to Contact, only their own messages (sent by or addressed to them) are visible in the History panel and accessible as expected.

With Account-level permissions I would expect the portal user to have access to all emails related to the Account they are linked to. The list in the History panel reflects this correctly. However, the Emails module — which displays the email contents — and the Stream (where these emails are embedded) do not follow the same logic.

The portal user is linked to the same Account as the one associated with the email. I’ve tested this with multiple users and verified permissions and email associations. In my setup, most emails are primarily linked to a Case, but changing the parent entity does not affect this behavior.

Roles:



Portal user view (on Case):




Email view by admin:



Portal user configuration:



EspoCRM version: 9.1.8.

Any ideas? Thanks in advance...

Regards, Jacek

[victor]

Try to put the current account "Urząd Gminy Gruszkowo" as Parent in these emails, and not the entry of Case "Ikona przesunęła się", as in your screenshot.

[jacao]

Changing parent to Account on email record changes... nothing. I've mention it

[victor]

Does the Portal User have the same email address in the Email field as the Account or Contact in their Contact or Account profile?

[jacao]

Yes, it does. Portal users is created on Contact and has the same email and Account assignement. As I wrote all others Access roles works properly except Account level. Portal user see list of emails (all emails connected with account) but cannot see body of it (only own).

[jacao]

We tested our case on Espo versions 9.1.7 and 8.4.2, and the behavior is exactly the same. The logs indicate a lack of access:

[2025-08-07 08:27:45] DEBUG: API (403) No 'read' access.; GET /678e414d0e24731ff/Email/68835e8b8e20514d4; Route pattern: /{portalId}/{controller}/{id}; Route params: Array (     [controller] => Email     [action] => read     [id] => 68835e8b8e20514d4     [portalId] => 678e414d0e24731ff )
[2025-08-07 08:27:45] NOTICE: (403) No 'read' access. :: GET /678e414d0e24731ff/Email/68835e8b8e20514d4 :: /var/www/html/application/Espo/Core/Record/Service.php(276)
[2025-08-07 08:27:49] DEBUG: BPM: processPendingFlows (all)
[2025-08-07 08:27:49] DEBUG: BPM: processTriggeredSignals
[2025-08-07 08:27:53] DEBUG: API (403) No 'read' access.; GET /678e414d0e24731ff/Email/689367621ca17b39a; Route pattern: /{portalId}/{controller}/{id}; Route params: Array (     [controller] => Email     [action] => read     [id] => 689367621ca17b39a     [portalId] => 678e414d0e24731ff )
[2025-08-07 08:27:53] NOTICE: (403) No 'read' access. :: GET /678e414d0e24731ff/Email/689367621ca17b39a :: /var/www/html/application/Espo/Core/Record/Service.php(276)

Please note that the issue affects only the Email entity and only when the permission level is set to Account. Moreover, changing the permission level from Contact to Account correctly exposes the list of emails related to the organization (as expected), but access to the email content itself is still denied.

In my opinion, this is a system bug. yuri , I kindly ask you to take a look and share your thoughts on this issue.

[arturkulik]

We tested our case on Espo versions 9.1.7 and 8.4.2, and the behavior is exactly the same. The logs indicate a lack of access:

[2025-08-07 08:27:45] DEBUG: API (403) No 'read' access.; GET /678e414d0e24731ff/Email/68835e8b8e20514d4; Route pattern: /{portalId}/{controller}/{id}; Route params: Array ( [controller] => Email [action] => read [id] => 68835e8b8e20514d4 [portalId] => 678e414d0e24731ff )
[2025-08-07 08:27:45] NOTICE: (403) No 'read' access. :: GET /678e414d0e24731ff/Email/68835e8b8e20514d4 :: /var/www/html/application/Espo/Core/Record/Service.php(276)
[2025-08-07 08:27:49] DEBUG: BPM: processPendingFlows (all)
[2025-08-07 08:27:49] DEBUG: BPM: processTriggeredSignals
[2025-08-07 08:27:53] DEBUG: API (403) No 'read' access.; GET /678e414d0e24731ff/Email/689367621ca17b39a; Route pattern: /{portalId}/{controller}/{id}; Route params: Array ( [controller] => Email [action] => read [id] => 689367621ca17b39a [portalId] => 678e414d0e24731ff )
[2025-08-07 08:27:53] NOTICE: (403) No 'read' access. :: GET /678e414d0e24731ff/Email/689367621ca17b39a :: /var/www/html/application/Espo/Core/Record/Service.php(276)

Please note that the issue affects only the Email entity and only when the permission level is set to Account. Moreover, changing the permission level from Contact to Account correctly exposes the list of emails related to the organization (as expected), but access to the email content itself is still denied.

In my opinion, this is a system bug. yuri , I kindly ask you to take a look and share your thoughts on this issue.

Even though portal user role has access to Accounts Emails,


user can read only account's emails created by himself, and see the list of all emails related, but read is restricted to own

[victor]

Why this could happen:

- It seems that initially you created a certain Contact A and/or Account B with the email address 1@.test.com.
- You corresponded and all emails were relayed to Contact A and/or Account B with the email address 1@.test.com.
- Then from this Contact A you created a Portal User C with the email address 1@.test.com and emails in the "History" of Portal User C also started to appear.
- The problem is that until the email address 1@.test.com was specified in the Portal User C profile, he did not/does not/will not have access to emails where he was added to the Assigned User or Assigned Users field. The display of these fields is configured in Administration > Entity Manager > Email > Layouts > Side Panel Fields.



How to avoid 403 error with old emails:

- Add Portal User C to each problematic email as an Assigned User.
- This needs to be done for each individual email, or create an email or workflow that will change the Assigned User field to Portal User C. Please note that for old emails in this context, the Assigned User field is required, not Assigned Users.




How to avoid 403 error with new emails:

1. Add the email address 1@.test.com Portal User C to the Email field in his user profile.
2. Now every new email in the Assigned Users field will automatically include Portal User C.

[arturkulik]

Thank You, I'll test it tommorow

[jacao]

Thank you, Victor, for your creative approach and suggested workaround. It may be sufficient as a temporary fix, but I can’t accept that this is how it’s supposed to work in the long run.

As for the use case and reproduction steps, here’s what it looks like:

1. I create a new organization “Account B” in EspoCRM.
2. I add two contacts to this organization: Contact No. 1 with email contact_1@ and Contact No. 2 with email contact_2@.
3. I then create corresponding portal users linked to these contacts and using the same email addresses.

Next, I send emails to a group mailbox linked with Cases. New cases are created as expected. The emails are correctly linked to Account B, and the user is also added to Assigned Users.



At this point, I believe that with portal user permissions set to Email → Read [Account], the emails should be visible to both portal users No. 1 and No. 2. This works correctly for the email list, but not for the email content itself.

I’d like to highlight that for other entities (e.g., Contact or custom entities), Read [Account] permissions work properly and intuitively. It really looks like this issue occurs only with the Email entity. In fact, in /espo/application/Espo/Classes/AclPortal/ there are dedicated files handling permissions for four entities, including Email (as well as Attachment, Note, Notification, and Email).

I’ve tested this across multiple fresh EspoCRM installations and I’m convinced this is a bug in the core code. Unfortunately, my programming skills are limited, and even with AI assistance I wasn’t able to find a fix. I experimented with modifying the ACL files and even tried custom implementations, but without success.

I’m a bit surprised that no one else has commented on this yet — it seems as if the feature of sharing emails across portal users within the same organization isn’t being used by others? Or maybe it just hasn’t caught much attention.

I was also hoping for some confirmation from the Espo developers that this is indeed a bug in the core. It’s not a critical one, but I think it’s worth noting and hopefully could be addressed in one of the upcoming releases.

TGIF & regards, Jacek

[victor]

In your case: if there is only one Account and more than one Contact, it is more appropriate to provide Email → Read [Contact], not Email → Read [Account].

[jacao]

It's just example to show the problem. Giving more Accounts and users do not solve it

We have over 5000 accounts and preparing to run portal for more than 50 000 users (5-15 users for account). So it is a problem...

[victor]

Please try to describe your desired functionality as concisely as possible in a separate topic in the section: https://forum.espocrm.com/forum/feature-requests.

[jacao]

I’ll go ahead and do that, although I still strongly believe that what I need here is not a new feature for EspoCRM, but rather a fix for an existing issue in how portal user permissions are validated at the Account level for the Email entity.

That’s why it’s very important for me to hear yuri perspective on whether what I’ve described is the system’s intended behavior.