function readOnly(count){ }
Starting November 20, the site will be set to read-only. On December 4, 2023,
forum discussions will move to the Trailblazer Community.
+ Start a Discussion
Prateek Kumar 11Prateek Kumar 11 

DML fails abruptly with error INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY

In our org, there is some code which tries to update a junction object record in the process of an account merge. The junction object's primary MD relation is with the standard Account object which has been shared with the user using sharing rules and provided Read/Write Access, and for the the sceondary MD relation object which is a custom object we have provided Modify All permission in the profile. 
From the UI, the user is able to edit the junction object.  However, sometimes the DML updates fails abruptly
And the logs show error as below:

05:46:48.538 (19720154513)|DML_BEGIN|[285]|Op:Update|Type:SObject|Rows:1
05:46:48.538 (19739132178)|DML_END|[285]
05:46:48.538 (19739187685)|EXCEPTION_THROWN|[285]|System.DmlException: Update failed. First exception on row 0 with id a4h16000001AAFXAA4; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id: []
05:46:48.538 (19739839199)|SYSTEM_MODE_EXIT|false


Sometimes, the DML fails on the account object as well. This DML statement is just after the junction object update mentioned above. And the logs show the same error as below:

12:00:12.137 (10288991686)|DML_BEGIN|[287]|Op:Update|Type:Account|Rows:1
12:00:12.137 (10289002209)|LIMIT_USAGE|[287]|DML|6|150
12:00:12.137 (10289012816)|LIMIT_USAGE|[287]|DML_ROWS|7|10000
12:00:12.137 (10289028157)|HEAP_ALLOCATE|[EXTERNAL]|Bytes:8
12:00:12.137 (10321783883)|DML_END|[287]
12:00:12.137 (10321853231)|EXCEPTION_THROWN|[287]|System.DmlException: Update failed. First exception on row 0 with id 0011600001vEVpYAAW; first error: INSUFFICIENT_ACCESS_ON_CROSS_REFERENCE_ENTITY, insufficient access rights on cross-reference id: []
12:00:12.137 (10323198564)|HEAP_ALLOCATE|[287]|Bytes:184


I'm not able to understand what exactly is cause of these DML updates failing? Could someone with knowledge on this help me resolve this.

Thanks
Guy Farrer FisherGuy Farrer Fisher
Can you add the trigger. It maybe that you are attempting to share the record with a user that already has the level of access on the Account that you are attempting to grant them which would throw an error. Query the AccountShare object for the user Id and the record Id and then if they do not have the neccsarry access add the new line. You maybe already doing this but without you class I can't see.
Prateek Kumar 11Prateek Kumar 11
Hi Guy Farrer,

The code is too complex to share. However, all that the code does is checks(marks it true) the Primary check box on the junction object based on some criteria and updates the field on Account object, which is the main M-D object, with the name of the junction object record which has the Primary check box checked.

Not sure if it helps. 
Guy Farrer FisherGuy Farrer Fisher
There are a few reasons you may get this error. Is is particular users that it doesn't work for, is there some sort of pattern that you can see for when it errors or not. 
Guy Farrer FisherGuy Farrer Fisher
Are you firing the trigger on update? Has the child been moved to the new parent before you are attempting to update it?