SonarSource/sonarqube · error · ForbiddenException

Insufficient privileges

Error message

Insufficient privileges

What it means

The SonarQube Web API 'api/settings/values' component lookup rejects users who lack permission on the requested component. loadComponent resolves the component key to an entity, then requires USER (or SCAN) entity permission on that entity, or global SCAN permission. If none hold, insufficientPrivilegesException() is thrown so the API does not leak settings of projects the caller cannot see.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/setting/ws/ValuesAction.java:153

      result = ImmutableSet.copyOf(keys);
    }
    result.forEach(SettingsWsSupport::validateKey);
    return result;
  }

  private Optional<EntityDto> loadComponent(DbSession dbSession, ValuesRequest valuesRequest) {
    String componentKey = valuesRequest.getComponent();
    if (componentKey == null) {
      return Optional.empty();
    }

    EntityDto entity = dbClient.entityDao().selectByKey(dbSession, componentKey)
      .orElseThrow(() -> new NotFoundException(format("Component key '%s' not found", componentKey)));

    if (!userSession.hasEntityPermission(USER, entity) &&
      !userSession.hasEntityPermission(ProjectPermission.SCAN, entity) &&
      !userSession.hasPermission(GlobalPermission.SCAN)) {
      throw insufficientPrivilegesException();
    }
    return Optional.of(entity);
  }

  private List<Setting> loadSettings(DbSession dbSession, Optional<EntityDto> component, Set<String> keys) {
    // List of settings must be kept in the following orders : default -> global -> component
    List<Setting> settings = new ArrayList<>();
    settings.addAll(loadDefaultValues(keys));
    settings.addAll(loadGlobalSettings(dbSession, keys));
    component.ifPresent(c -> settings.addAll(loadComponentSettings(dbSession, c, keys)));
    return settings.stream()
      .filter(s -> settingsWsSupport.isVisible(s.getKey(), component))
      .toList();
  }

  private Collection<Setting> loadComponentSettings(DbSession dbSession, EntityDto entity, Set<String> keys) {
    return loadComponentSettings(dbSession, keys, entity.getUuid());
  }

View on GitHub (pinned to 184c821202)

Solutions

1. Grant the user (or the account's group) USER or Execute Analysis (SCAN) permission on the target project: Project Settings > Permissions.
2. Alternatively grant the global Execute Analysis permission if the integration legitimately scans/reads all projects.
3. Verify you are calling with a token belonging to the intended account, not an expired or reassigned token.
4. If read access only is needed and cannot be granted, use an account with the required permission for the API call.

Example fix

// before: call with underprivileged token
curl -u underprivilegedToken: http://sonar/api/settings/values?component=my_project

// after: grant USER/SCAN permission on my_project to the token's user, or use an admin/scanner account
curl -u scannerToken: http://sonar/api/settings/values?component=my_project

// Java client-side pre-check: does the user hold required permission?
// GET /api/permissions/permission_templates or simpler: probe the project
WSResponse resp = wsClient.get("api/projects/search").failIfNotOk(); // project visible only if USER permission held
// If the target project is not in the result list for this user, skip the settings call.

boolean canReadSettings(UserSession s, EntityDto e) { return s.hasEntityPermission(USER, e) || s.hasEntityPermission(ProjectPermission.SCAN, e) || s.hasPermission(GlobalPermission.SCAN); }

When it happens

Trigger: Calling GET api/settings/values with a component (or componentKeys) parameter while the authenticated user has neither the USER nor SCAN permission on that project, nor the global Execute Analysis (SCAN) permission.

Common situations: CI tokens used to read project settings without 'Execute Analysis' permission; users browsing settings of a project they are not a member of; automation scripts reusing a user account that lost project access after permission reshuffling.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Provided user with login '%s' does not have 'Browse' permiss

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/98cda0dec86c5242. Report an issue: GitHub.