I am inserting a manual share record for a custom object (Request__c) and getting the error: "Insert failed... insufficient access rights on cross-reference id: []".

When I comment out the insertion of the Request__share record the error does not occur so I know it's specific to that insert. The class is running without sharing. The user performing the action has access to the relevant record type on the Request__c object. I debugged all the variables being used to create

Any ideas what might be causing the insert to fail? I feel like it may be security related, but I'm not sure how to check what permissions are needed to insert a Request__share record. It's running without sharing so I'm not sure what the issue could be.

Relevant code:

sharingToCreate.add(new Request__Share(
                    AccessLevel = 'Read',
                    RowCause = 'Manual',
                    ParentId = requestId,
                    UserOrGroupId = piwi.ActorId

insert sharingToCreate;
  • is the UserOrGroupId already the record owner? that can cause this issue
    – cropredy
    Jul 28, 2022 at 17:31
  • @cropredy thanks for your response. No the UserOrGroupId is not the owner of the Request__c record. The owner of the record is a portal user though, and that's who I am performing the action with. Would it have something to do with them being a portal user?
    – Tom
    Jul 28, 2022 at 17:41
  • Which license type ? Community or CommunityPlus?
    – cropredy
    Jul 28, 2022 at 17:51
  • 1
    Can you please share what is the default external access for this user from Sharing settings? Jul 28, 2022 at 17:53
  • @cropredy The license type is High Volume Customer Portal. @Nagendra I'm not sure how to see user-specific sharing settings, but if I open Sharing Settings, the Default External Access for the Request__c object is Private. But wouldn't that be ignored, since the class is running without sharing? Thanks!
    – Tom
    Jul 28, 2022 at 18:21

1 Answer 1


As noted by the OP, the running user is a High Volume Customer Portal user. These users have restrictions on sharing as outlined in About High-Volume Community or Site Users

  • High-volume users can’t manually share records they own or have access to.
  • Only share the records they own with authenticated Salesforce users in Share Groups
  • Only share the records they own in guest user or criteria-based sharing rules

You'll need to check the running user's UserType and avoid the insert ...

if (UserInfo.getUserType() == 'CSPLitePortal') {..do nothing..}

Apex ref

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .