SonarSource/sonarqube · error · ForbiddenException

Insufficient privileges

Error message

Insufficient privileges

What it means

QualityGatesWsSupport.checkCanLimitedEdit guards web services that allow limited modification of a quality gate (e.g., associating projects). The user must either hold the global ADMINISTER_QUALITY_GATES permission or have a user- or group-level editing permission on that specific gate; otherwise insufficientPrivilegesException is thrown. Built-in gates are rejected earlier by checkNotBuiltIn regardless of permissions.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/qualitygate/ws/QualityGatesWsSupport.java:76

  QualityGateConditionDto getCondition(DbSession dbSession, String uuid) {
    return checkFound(dbClient.gateConditionDao().selectByUuid(uuid, dbSession), "No quality gate condition with uuid '%s'", uuid);
  }

  boolean isQualityGateAdmin() {
    return userSession.hasPermission(ADMINISTER_QUALITY_GATES);
  }

  void checkCanEdit(QualityGateDto qualityGate) {
    checkNotBuiltIn(qualityGate);
    userSession.checkPermission(ADMINISTER_QUALITY_GATES);
  }

  void checkCanLimitedEdit(DbSession dbSession, QualityGateDto qualityGate) {
    checkNotBuiltIn(qualityGate);
    if (!userSession.hasPermission(ADMINISTER_QUALITY_GATES)
      && !hasLimitedPermission(dbSession, qualityGate)) {
      throw insufficientPrivilegesException();
    }
  }

  boolean hasLimitedPermission(DbSession dbSession, QualityGateDto qualityGate) {
    return userHasPermission(dbSession, qualityGate) || userHasGroupPermission(dbSession, qualityGate);
  }

  boolean userHasGroupPermission(DbSession dbSession, QualityGateDto qualityGate) {
    return userSession.isLoggedIn() && dbClient.qualityGateGroupPermissionsDao().exists(dbSession, qualityGate, userSession.getGroups());
  }

  boolean userHasPermission(DbSession dbSession, QualityGateDto qualityGate) {
    return userSession.isLoggedIn() && dbClient.qualityGateUserPermissionDao().exists(dbSession, qualityGate.getUuid(), userSession.getUuid());
  }


  void checkCanAdminProject(ProjectDto project) {
    if (userSession.hasPermission(ADMINISTER_QUALITY_GATES)

View on GitHub (pinned to 184c821202)

Solutions

1. Grant the user global 'Administer Quality Gates' permission via Administration > Security > Permission Templates / Global permissions.
2. Or grant user- or group-level permission on the specific quality gate via api/qualitygates/add_user or api/qualitygates/add_group.
3. Confirm you are not targeting a built-in gate; built-in gates cannot be edited at all.
4. If the operation should be admin-only, use a token of a quality-gate administrator.

Example fix

// before: regular user attempts gate edit
curl -u usertoken: -X POST "$SONAR/api/qualitygates/copy?name=Sonar%20way"

// after: grant per-gate permission first
curl -u admintoken: -X POST "$SONAR/api/qualitygates/add_user?gateName=Sonar%20way&login=jdoe"

// Built-in gates can never be edited; skip them upfront:
if ("Sonar way".equals(gateName)) throw new IllegalArgumentException("Built-in gate is not editable");
// Check caller has global gate-admin permission:
curl -u "$TOKEN": "$SONAR/api/permissions/user?login=$USER" | grep 'gateadmin'

When it happens

Trigger: Calling gate-modification web services such as api/qualitygates/create, copy, or association endpoints as a user without global 'Administer Quality Gates' and without per-gate user/group permission (e.g., api/qualitygates/add_user or add_group permission entries for that gate). Also thrown when targeting a built-in gate name is passed (checkNotBuiltIn throws IllegalArgumentException there, not this error).

Common situations: Delegated gate admins who were given per-gate permissions later removed; users attempting to edit the built-in 'Sonar way' gate's project associations; permission model migrations after upgrading SonarQube that dropped per-gate grants.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges
• Insufficient privileges

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/df6deefc05e18bc6. Report an issue: GitHub.