SonarSource/sonarqube · error · ForbiddenException

Insufficient privileges

Error message

Insufficient privileges

What it means

api/projects/update_visibility requires the caller to be a project admin on the entity AND either a system administrator or the server setting allowing project admins to change permissions/visibility must be enabled. validateRequest throws 'Insufficient privileges' when the user is not a project admin, or is neither global admin nor covered by the allowChangingPermissionsByProjectAdmins flag.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/project/ws/UpdateVisibilityAction.java:103

    boolean changeToPrivate = Visibility.isPrivate(request.mandatoryParam(PARAM_VISIBILITY));

    try (DbSession dbSession = dbClient.openSession(false)) {
      EntityDto entityDto = dbClient.entityDao().selectByKey(dbSession, entityKey)
        .orElseThrow(() -> BadRequestException.create("Component must be a project, a portfolio or an application"));

      validateRequest(dbSession, entityDto);
      visibilityService.changeVisibility(entityDto, changeToPrivate);
      response.noContent();
    }
  }

  private void validateRequest(DbSession dbSession, EntityDto entityDto) {
    boolean isGlobalAdmin = userSession.isSystemAdministrator();
    boolean isProjectAdmin = userSession.hasEntityPermission(ADMIN, entityDto);
    boolean allowChangingPermissionsByProjectAdmins = configuration.getBoolean(CORE_ALLOW_PERMISSION_MANAGEMENT_FOR_PROJECT_ADMINS_PROPERTY)
      .orElse(CORE_ALLOW_PERMISSION_MANAGEMENT_FOR_PROJECT_ADMINS_DEFAULT_VALUE);
    if (!isProjectAdmin || (!isGlobalAdmin && !allowChangingPermissionsByProjectAdmins)) {
      throw insufficientPrivilegesException();
    }
    if (entityDto.isProject()) {
      managedInstanceChecker.throwIfProjectIsManaged(dbSession, entityDto.getUuid());
    }
  }

}

View on GitHub (pinned to 184c821202)

Solutions

1. Add the user to the project's Admin permission list (Project Settings > Permissions).
2. Enable sonar.allowPermissionManagementForProjectAdmins=true on the server so project admins may change visibility.
3. Alternatively perform the change with a global administrator token.
4. If the project is managed by an external platform, change visibility there rather than via SonarQube.

Example fix

// before (sonar.properties)
# flag unset -> project admins blocked
// after
sonar.allowPermissionManagementForProjectAdmins=true
// and: Project Settings > Permissions > Administer -> add the user

const authz = await get(`/api/permissions/authorization?projectKey=${key}`, { auth: token });
const flag = (await get('/api/settings/values?keys=sonar.allowPermissionManagementForProjectAdmins')).settings[0].value === 'true';
if (!(authz.permissions.includes('admin') && (authz.globalPermissions.includes('admin') || flag))) throw new Error('Not allowed to change visibility');

function canChangeVisibility(authz, flagEnabled) {
  return Boolean(authz) && authz.permissions.includes('admin') && ((authz.globalPermissions || []).includes('admin') || flagEnabled);
}

try {
  await updateVisibility(key, visibility);
} catch (e) {
  if (e.response && e.response.status === 403) {
    throw new Error('Requires project Admin plus (global admin or allowPermissionManagementForProjectAdmins)', { cause: e });
  }
  throw e;
}

When it happens

Trigger: POST api/projects/update_visibility by a user without project Admin permission, or by a project admin on a server where core.allowPermissionManagementForProjectAdmins is false (default).

Common situations: Users who can see the project but are not on its Admin list; project admins whose visibility changes stopped working after upgrade because the new flag defaults to false; managed (devops-platform) projects also blocked by managedInstanceChecker.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/7b2e7ccf0fd8afe0. Report an issue: GitHub.