SonarSource/sonarqube · error · ForbiddenException

Insufficient privileges

Error message

Insufficient privileges

What it means

ForbiddenException 'Insufficient privileges' from /api/ce/cancel_task when the caller is not a system administrator and the queued task has no componentUuid (e.g. a Compute Engine task not tied to a project). Non-admins can only cancel tasks of projects where they hold Admin permission.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/ws/CancelAction.java:92

  public void handle(Request wsRequest, Response wsResponse) {
    String taskId = wsRequest.mandatoryParam(PARAM_TASK_ID);
    try (DbSession dbSession = dbClient.openSession(false)) {
      Optional<CeQueueDto> queueDto = dbClient.ceQueueDao().selectByUuid(dbSession, taskId);
      queueDto.ifPresent(dto -> {
        checkPermission(dbSession, dto);
        queue.cancel(dbSession, dto);
      });
    }
    wsResponse.noContent();
  }

  private void checkPermission(DbSession dbSession, CeQueueDto ceQueueDto) {
    if (userSession.isSystemAdministrator()) {
      return;
    }
    String componentUuid = ceQueueDto.getComponentUuid();
    if (componentUuid == null) {
      throw insufficientPrivilegesException();
    }
    Optional<ComponentDto> component = dbClient.componentDao().selectByUuid(dbSession, componentUuid);
    if (!component.isPresent()) {
      throw insufficientPrivilegesException();
    }
    userSession.checkComponentPermission(ProjectPermission.ADMIN, component.get());
  }
}

View on GitHub (pinned to 184c821202)

Solutions

  1. Perform the cancellation with a system-administrator account/token.
  2. Only cancel tasks that belong to a project on which you have 'Administer Project'; check GET /api/ce/task?id=... first.
  3. For project-less stuck tasks, restart the Compute Engine or ask an admin.
  4. Verify the task UUID via GET /api/ce/activity before canceling.

Example fix

// before
POST /api/ce/cancel_task?id=<internal-task-uuid>  -> 403 (no componentUuid, non-admin)
// after: run as admin token or target a project task you administer
POST /api/ce/cancel_task?id=<project-task-uuid>  (with project Admin permission)
Defensive patterns

Strategy: validation

Validate before calling

// before canceling, inspect the task
TASK=$(curl -s -u "$TOKEN:" "$SONAR/api/ce/task?id=$TASK_ID")
echo "$TASK" | grep -q '"componentUuid"' || echo "task has no component: admin required to cancel"

Try / catch

try {
  ws.post("/api/ce/cancel_task", form(id));
} catch (ForbiddenException e) {
  log.warn("Need admin or project Admin to cancel task {}", id);
  throw e;
}

Prevention

When it happens

Trigger: POST /api/ce/cancel_task?id=... for a project-less CE task (purge/migration/internal tasks) as a non-admin; canceling while the task's componentUuid is null.

Common situations: Attempting to clear a stuck background task via API without admin rights; automation scripts written for project tasks reused on internal tasks.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/4f918352dc072662. Report an issue: GitHub.