Some permissions cleared on Save in the User Role UI

[KennethBates]

Severity

One report with a workaround

Version

2026.3.15036

Latest Version

None

What happened?

Whenever a save is made to a user role in the UI, there are a few permissions that always end up unselected, whether they were ticked beforehand or trying to add them. These are the following permissions:

• RunbookRunDelete
• TargetTagAdminister
• TargetTagView

Reproduction

Attempt to add any of the following permissions to any user role. When you save, observe these permissions unticked.

Error and Stacktrace

POST succeeds in the API call, it just doesn't add these permissions to the payload.

More Information

Internal report

Workaround

Add these permissions directly via the API with the following script:

$OctopusUrl = "https://YourOctoUrl"
$Headers = @{ "X-Octopus-ApiKey" = "API-xxxxx" }
$RoleId = "UserRoles-ID"
$Permission = "RunbookRunDelete"

$role = Invoke-RestMethod -Uri "$OctopusUrl/api/userroles/$RoleId" -Headers $Headers -Method Get

if ($role.GrantedSpacePermissions -notcontains $Permission) {
$role.GrantedSpacePermissions += $Permission
}

Invoke-RestMethod -Uri "$OctopusUrl/api/userroles/$RoleId" -Headers $Headers -Method Put `
-ContentType "application/json" -Body ($role | ConvertTo-Json -Depth 10)