From ff41e8b868acca6aaf641a20baccef25aa8158e4 Mon Sep 17 00:00:00 2001
From: Peter Donker <peter@bring2mind.net>
Date: Fri, 30 Oct 2026 14:25:04 +0100
Subject: [PATCH] Ensure the user that created the token is the one added to
 the running thread so current user is correct on all calls.

---
 .../DotNetNuke.Web/Api/Auth/ApiTokens/ApiTokenController.cs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/DNN Platform/DotNetNuke.Web/Api/Auth/ApiTokens/ApiTokenController.cs b/DNN Platform/DotNetNuke.Web/Api/Auth/ApiTokens/ApiTokenController.cs
index 340bdbdefd4..50774bbf8d3 100644
--- a/DNN Platform/DotNetNuke.Web/Api/Auth/ApiTokens/ApiTokenController.cs	
+++ b/DNN Platform/DotNetNuke.Web/Api/Auth/ApiTokens/ApiTokenController.cs	
@@ -246,11 +246,11 @@ private static string GetHashedStr(string data)
                 }
 
                 apiToken.TokenKeys = apiToken.Keys.Split(',').ToList();
+                var userInfo = UserController.GetUserById(this.hostSettings, PortalSettings.PortalId, apiToken.CreatedByUserId);
 
                 switch (apiToken.Scope)
                 {
                     case ApiTokenScope.User:
-                        var userInfo = UserController.GetUserById(this.hostSettings, PortalSettings.PortalId, apiToken.CreatedByUserId);
                         if (userInfo == null)
                         {
                             Logger.ApiTokenControllerInvalidUser();
@@ -264,7 +264,7 @@ private static string GetHashedStr(string data)
                         if (apiToken.PortalId == PortalSettings.PortalId)
                         {
                             this.apiTokenRepository.SetApiTokenLastUsed(apiToken);
-                            return (apiToken, null);
+                            return (apiToken, userInfo);
                         }
 
                         break;
@@ -272,7 +272,7 @@ private static string GetHashedStr(string data)
                         if (apiToken.PortalId == -1)
                         {
                             this.apiTokenRepository.SetApiTokenLastUsed(apiToken);
-                            return (apiToken, null);
+                            return (apiToken, userInfo);
                         }
 
                         break;