Getting the following error INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY for a site guest user

Question

So I know similar questions has been asked before, but I couldn't find a solution using the following links: Link1, Link2, Link3 (and more)

The situation is as follows. So I have a form (a visualforce page) that some site members need to fill out. Initially, the information related to the member is stored in a custom object. Then the fields are converted into accounts. When they are stored as a custom object, we have a button that allows the sending of an email giving them the link to the form. This creates an EmailMessage with the relatedToId being that of the custom object. Then they sign in using a custom object that has a password field that functions as credentials.

So when they fill out the form, this triggers some code in an apex class that transfers all the fields from the custom object to an Account. One thing it also transfers is the emails associated with the custom objects. It will iterate through all of the emails and reinsert them with the relatedToId being that of the new account.

Here is the code snippet that does this. CurrentApp refers to our custom object.

List<EmailMessage> messages = [select id, relatedToId, Subject, HTMLBody, MessageDate, Status from EmailMessage where relatedToId = :CurrentApp.Id];
for(EmailMessage message : messages)
{
    insert new EmailMessage(
        Subject = message.Subject,
        HTMLBody = message.HTMLBody,
        RelatedToId = NewAccount.id,
        MessageDate = message.MessageDate,
        Status = message.Status);
}

But when they try to do this, it will trigger an exception:

type: System.DmlException
message: Insert failed. First exception on row 0; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id: []

The line mentioned in the stack trace is the insert new EmailMessage line. From the links I read, I'm assuming this is because the site guest user doesn't have permission to create a new email message.

The thing is we have a button on the custom object's page layout that uses the same exact code to do the conversion, and it always works if we press that button. So I tried to edit the CRUD permissions of the EmailMessage object. I went to setup -> profiles -> System Administrator (also the site guest profile) -> object settings -> EmailMessage -> Edit, and there were no CRUD permissions there.

The following link shows some screenshots of what I see. Link

So as you can see on both the System Admin and the Site Guest Profile, there are no CRUD permissions that I can change on the Email Address, and the third image shows a what an object's settings with CRUD permissions looks like.

I've tried going through the process in a sandbox version of the page, and sometimes it actually goes through without triggering the error. A week ago, we had some people go through this process, and it wouldn't trigger this error either. This code has also been here for a while with no one making any changes to it, so I'm not sure why this bug popped up all of a sudden.

Does anyone have any ideas on how to fix this? Is an email message just a special object? I'm not really too familiar with Salesforce, and it just doesn't make sense to me how this error is not always replicable. Is there another place where I should be editing the object's properties? I would appreciate any help at all; I've been stuck on this issue for several days already.

Answer 1

Thank you so much. cropredy was right.

So I went to sharing settings for the Account and tried to create a Sharing Rule with our Guest Users. However, it only allowed it to be Read Only since its still a guest user, and this still caused the exception. I'm guessing because associating an email with the account is still considered a "write" operation.

So I had to go to the Organization-Wide Defaults and for the Account and Contract and change the "Default External Access" from "Private" to "Public Read/Write". I feel like this is not exactly the safest way to get around this issue, so if anyone else has any other ideas, feel free to suggest them.

Edit: I also had to disable "Secure guest user record access" for it to work.

Answer 2

Normally You see the Insufficient Privileges error if you don’t have the right access on different levels. For example, your profile prevents you from accessing the account object, or your role prevents you from accessing a case record. You also see an Insufficient Privileges error when you click a link to a record or a Visualforce page tab to which you don’t have access.

you can try to declare your class with the keyword without sharing . Ex. public without sharing class createAccount{}

Use the without sharing keyword when declaring a class to ensure that the sharing rules for the current user are not enforced. For example, you can explicitly turn off sharing rule enforcement when a class is called from another class that is declared using with sharing.