Sorry, you are not allowed to customise this site

I’ve just installed wordpress (via Virtualmin), version 5.8.3

I haven’t installed any plugins or done anything like that. The only thing I did was change the settings (and copied the index.php etc) so that even though it lives in /wordpress it runs off the domain root. I haven’t worked with wordpress in years so I was just having a poke around and tried to customize the theme. At first it seems like the customiser loads but then it just displays the “You need a higher level of permission. Sorry, you are not allowed to customise this site.” message.

In the console I’m seeing 2 messages:
SyntaxError: invalid identity escape in regular expression in editor.min.js and An iframe which has both allow-scripts and allow-same-origin for its sandbox attribute can remove its sandboxing. in customize.php
I don’t know if those are relevant. I suspect it is related to a 403 error I’m getting on this url
https://dev.example.com/wp-json/wp/v2/widget-types?context=edit&per_page=100&_locale=user
Most of the other requests I’m seeing do include /wordpress/ this one doesn’t. I’m sure I could find and fix it in the code but that doesn’t seem to be an optimal solution.