pimcore-skeleton upgrade from 2025.1 to 2025.4, installing studio UI, admin login studio UI does not have permission

[max-zhang78]

It's strange that Pimcore upgraded from 2025.1 to 2025.4, installing studio UI, but admin doesn't have permission

Request URL
https://www.com/pimcore-studio/api/perspectives/configurations

Request Method
GET

Status Code
403 Forbidden

I tried to create a new role, enrich all permissions, and enrich the role with a new account, but there are still permission issues

[root@update-pimcore packages]# cat security.yaml
security:
#enable_authenticator_manager: true

providers:
    pimcore_admin:
        id: Pimcore\Security\User\UserProvider

firewalls:
    dev:
        pattern: ^/(_(profiler|wdt)|css|images|js)/
        security: false

    # Pimcore WebDAV HTTP basic // DO NOT CHANGE!
    pimcore_webdav:
        pattern: ^/asset/webdav
        provider: pimcore_admin
        http_basic: ~

    # Pimcore Admin Bundle firewall
    pimcore_admin: '%pimcore_admin_bundle.firewall_settings%'

    pimcore_mcp: '%pimcore_studio_backend.mcp_firewall_settings%'
    pimcore_studio: '%pimcore_studio_backend.firewall_settings%'

access_control:
    # Pimcore admin ACl  // DO NOT CHANGE!
    - { path: ^/admin/settings/display-custom-logo, roles: PUBLIC_ACCESS }
    - { path: ^/admin/login/2fa-verify, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
    - { path: ^/admin/login/2fa-setup, roles: ROLE_PIMCORE_USER }
    - { path: ^/admin/login/2fa, roles: IS_AUTHENTICATED_2FA_IN_PROGRESS }
    - { path: ^/admin/login$, roles: PUBLIC_ACCESS }
    - { path: ^/admin/login/(login|lostpassword|deeplink|csrf-token)$, roles: PUBLIC_ACCESS }
    - { path: ^/admin, roles: ROLE_PIMCORE_USER }
    - { path: ^/asset/webdav, roles: ROLE_PIMCORE_USER }

    - { path: ^/pimcore-studio/api/(docs|docs/json|translations|user/reset-password|setting/admin/thumbnail)$, roles: PUBLIC_ACCESS }
    - { path: ^/pimcore-studio/api, roles: ROLE_PIMCORE_USER }
    - { path: ^/pimcore-mcp/, roles: ROLE_PIMCORE_USER }

role_hierarchy:
    # Pimcore admin  // DO NOT CHANGE!
    ROLE_PIMCORE_ADMIN: [ROLE_PIMCORE_USER]

.env
APP_ENV=dev
APP_DEBUG=true
PIMCORE_DEV_MODE=false

TRUSTED_PROXIES=127.0.0.0/8,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.18.0.1/16
TRUSTED_HOSTS='^(localhost|xxxxx.com)$'
###< symfony/framework-bundle ###

MAILER_DSN=x

PIMCORE_GOTENBERG_URL=http://gotenberg:3000

REDIS_DSN=redis://redis:6379

MESSENGER_TRANSPORT_DSN=doctrine://default

USE_MODSECURITY=yes
MODSECURITY_DETECTION_ONLY=yes
WHITELIST_URI_WAF=/admin/.|/pimcore-studio/.

PIMCORE_OPENSEARCH_DSN=opensearch://admin:admin@opensearch:9200?ssl=true&ssl_verify=false
#PIMCORE_MESSENGER_TRANSPORT_DSN_PREFIX=amqp://rabbitmq:5672/%2f/
PIMCORE_MESSENGER_TRANSPORT_DSN_PREFIX=amqp://guest:guest@rabbitmq:5672/%2f/
PIMCORE_OPENSEARCH_VERIFY_CERTIFICATE=false

APPLICATION_SECRET=6UzPMUdhv74lceb09v

I logged in with admin use as super admin, but it still shows Access Denied 403

api shows
{
"message": "Access Denied.",
"detail": "#0 /var/www/html/vendor/symfony/security-http/Firewall/ExceptionListener.php(93): Symfony\Component\Security\Http\Firewall\ExceptionListener-\u003EhandleAccessDeniedException(Object(Symfony\Component\HttpKernel\Event\ExceptionEvent), Object(Symfony\Component\Security\Core\Exception\AccessDeniedException))\n#1 /var/www/html/vendor/symfony/event-dispatcher/Debug/WrappedListener.php(115): Symfony\Component\Security\Http\Firewall\ExceptionListener-\u003EonKernelException(Object(Symfony\Component\HttpKernel\Event\ExceptionEvent), \u0027kernel.exceptio...\u0027, Object(Symfony\Component\HttpKernel\Debug\TraceableEventDispatcher))\n#2 /var/www/html/vendor/symfony/event-dispatcher/EventDispatcher.php(206): Symfony\Component\EventDispatcher\Debug\WrappedListener-\u003E__invoke(Object(Symfony\Component\HttpKernel\Event\ExceptionEvent), \u0027kernel.exceptio...\u0027, Object(Symfony\Component\HttpKernel\Debug\TraceableEventDispatcher))\n#3 /var/www/html/vendor/symfony/event-dispatcher/EventDispatcher.php(56): Symfony\Component\EventDispatcher\EventDispatcher-\u003EcallListeners(Array, \u0027kernel.exceptio...\u0027, Object(Symfony\Component\HttpKernel\Event\ExceptionEvent))\n#4 /var/www/html/vendor/symfony/event-dispatcher/Debug/TraceableEventDispatcher.php(129): Symfony\Component\EventDispatcher\EventDispatcher-\u003Edispatch(Object(Symfony\Component\HttpKernel\Event\ExceptionEvent), \u0027kernel.exceptio...\u0027)\n#5 /var/www/html/vendor/symfony/http-kernel/HttpKernel.php(241): Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher-\u003Edispatch(Object(Symfony\Component\HttpKernel\Event\ExceptionEvent), \u0027kernel.exceptio...\u0027)\n#6 /var/www/html/vendor/symfony/http-kernel/HttpKernel.php(91): Symfony\Component\HttpKernel\HttpKernel-\u003EhandleThrowable(Object(Symfony\Component\Security\Core\Exception\AccessDeniedException), Object(Symfony\Component\HttpFoundation\Request), 1)\n#7 /var/www/html/vendor/symfony/http-kernel/Kernel.php(193): Symfony\Component\HttpKernel\HttpKernel-\u003Ehandle(Object(Symfony\Component\HttpFoundation\Request), 1, true)\n#8 /var/www/html/vendor/symfony/runtime/Runner/Symfony/HttpKernelRunner.php(35): Symfony\Component\HttpKernel\Kernel-\u003Ehandle(Object(Symfony\Component\HttpFoundation\Request))\n#9 /var/www/html/vendor/autoload_runtime.php(32): Symfony\Component\Runtime\Runner\Symfony\HttpKernelRunner-\u003Erun()\n#10 /var/www/html/public/index.php(16): require_once(\u0027/var/www/html/v...\u0027)\n#11 {main}"
}

[max-zhang78]

Is this a bug or is there a way to fix admin permission issues？

[max-zhang78]

sorry，Forgot to execute bin/console doctrine:migrations:migrate

[max-zhang78]

supervisord consume message there are issues with memory overflow and queue blocking