What causes "Insufficient privileges" in SonarSource/sonarqube?

Grant the user Browse (USER) permission on the component/project: Project Settings > Permissions.

SonarSource/sonarqube · error · ForbiddenException

Insufficient privileges

Error message

Insufficient privileges

What it means

The SonarQube Web API component navigation action ('api/navigation/component' / component tree root detail) requires the caller to hold USER or ADMIN permission on the component, or be a system administrator. When the user session has none of these, the handler throws the insufficient-privileges exception instead of returning component data, preventing information disclosure about projects the caller cannot access.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/ui/ws/ComponentAction.java:161

      .setExampleValue(KEY_PULL_REQUEST_EXAMPLE_001);
  }

  @Override
  public void handle(Request request, Response response) throws Exception {
    String componentKey = request.mandatoryParam(PARAM_COMPONENT);
    try (DbSession session = dbClient.openSession(false)) {
      String branch = request.param(PARAM_BRANCH);
      String pullRequest = request.param(PARAM_PULL_REQUEST);
      ComponentDto component = componentFinder.getByKeyAndOptionalBranchOrPullRequest(session, componentKey, branch, pullRequest);
      checkComponentNotAModuleAndNotADirectory(component);
      ComponentDto rootComponent = getRootProjectOrBranch(component, session);
      // will be empty for portfolios
      Optional<BranchDto> branchDto = dbClient.branchDao().selectByUuid(session, rootComponent.branchUuid());
      String projectOrPortfolioUuid = branchDto.map(BranchDto::getProjectUuid).orElse(rootComponent.branchUuid());
      if (!userSession.hasComponentPermission(USER, component) &&
        !userSession.hasComponentPermission(ADMIN, component) &&
        !userSession.isSystemAdministrator()) {
        throw insufficientPrivilegesException();
      }
      Optional<SnapshotDto> analysis = dbClient.snapshotDao().selectLastAnalysisByRootComponentUuid(session, component.branchUuid());

      try (JsonWriter json = response.newJsonWriter()) {
        json.beginObject();
        boolean isFavourite = isFavourite(session, projectOrPortfolioUuid, component);
        writeComponent(json, component, analysis.orElse(null), isFavourite, branchDto.map(BranchDto::getBranchKey).orElse(null));
        writeProfiles(json, session, component);
        writeQualityGate(json, session, projectOrPortfolioUuid);
        if (userSession.hasComponentPermission(ADMIN, component) ||
          userSession.hasComponentPermission(ARCHITECTURE_ADMIN, component) ||
          userSession.hasPermission(ADMINISTER_QUALITY_PROFILES) ||
          userSession.hasPermission(ADMINISTER_QUALITY_GATES)) {
          writeConfiguration(json, component);
        }
        writeBreadCrumbs(json, session, component);
        json.endObject().close();
      }

View on GitHub (pinned to 184c821202)

Solutions

Grant the user Browse (USER) permission on the component/project: Project Settings > Permissions.
Grant ADMIN permission only if administration data is actually needed.
Use a system administrator account for admin-level navigation queries.
Update the client to handle a 403 gracefully and prompt the user to request access.

Example fix

// before
curl -u limitedUser: http://sonar/api/navigation/component?component=uuid-of-project

// after: grant Browse permission to limitedUser on the project
curl -u limitedUser: http://sonar/api/navigation/component?component=uuid-of-project

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-check via the WS client before navigation call:
// GET /api/components/show?component=<key> will 403 for unauthorized users too;
// better: GET /api/projects/search and verify the component key is visible to the user.

Try / catch

try {
  ComponentWsResponse r = wsClient.navigationComponent().execute();
} catch (SonarQubeClientException e) { // or check response.code()==403
  if (e.status() == 403) {
    ui.showAccessDenied("You do not have permission to view this component");
  } else throw e;
}

Prevention

Grant Browse permission to the groups/users that legitimately navigate to the project.
Avoid sharing component URLs across users with different permission sets.
Check permissions reactively in the UI after permission changes.
Use system administrator accounts only for admin diagnostics.

When it happens

Trigger: Requesting the component navigation endpoint for a root component where the logged-in user has neither Browse (USER) nor Administer (ADMIN) component permission and is not a system administrator.

Common situations: Frontend navigation stale after permissions changed; shared bookmarks/URLs to a component the viewer cannot see; third-party dashboards calling the navigation API with a limited-service account.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/6f46c8bac9ebba2f. Report an issue: GitHub.