SonarSource/sonarqube · error · ForbiddenException

Insufficient privileges

Error message

Insufficient privileges

What it means

ForbiddenException 'Insufficient privileges' from /api/ce/task (and related task endpoints) when the user lacks any of: global Administer, global Execute Analysis (Scan), project Administer, or project Execute Analysis on the task's component, and additional task details are being requested. Only users with at least Scan-level access on the project may view its task details.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/ws/TaskAction.java:146

    return dbClient.componentDao().selectByUuid(dbSession, projectUuid);
  }

  private void checkPermission(Optional<ComponentDto> component) {
    if (component.isPresent()) {
      checkComponentPermission(component.get());
    } else {
      userSession.checkIsSystemAdministrator();
    }
  }

  private void checkComponentPermission(ComponentDto component) {
    if (userSession.hasPermission(GlobalPermission.ADMINISTER) ||
      userSession.hasPermission(GlobalPermission.SCAN) ||
      userSession.hasComponentPermission(ProjectPermission.ADMIN, component) ||
      userSession.hasComponentPermission(ProjectPermission.SCAN, component)) {
      return;
    }
    throw insufficientPrivilegesException();
  }

  private static void maskErrorStacktrace(CeActivityDto ceActivityDto, Set<AdditionalField> additionalFields) {
    if (!additionalFields.contains(AdditionalField.STACKTRACE)) {
      ceActivityDto.setErrorStacktrace(null);
    }
  }

  @CheckForNull
  private String extractScannerContext(DbSession dbSession, CeActivityDto activityDto, Set<AdditionalField> additionalFields) {
    if (additionalFields.contains(AdditionalField.SCANNER_CONTEXT)) {
      return dbClient.ceScannerContextDao().selectScannerContext(dbSession, activityDto.getUuid())
        .orElse(null);
    }
    return null;
  }

  private enum AdditionalField {

View on GitHub (pinned to 184c821202)

Solutions

  1. Grant the token's user 'Execute Analysis' (or 'Administer') permission on the relevant project(s).
  2. Use a user with global 'Execute Analysis' for cross-project monitoring scripts.
  3. Restrict queries to tasks of projects the user can access; filter /api/ce/activity by authorized component keys.
  4. Confirm the task's project key and re-check GET /api/projects/create permission listing for the user.

Example fix

// before
GET /api/ce/task?id=AX..&additionalFields=stacktrace -> 403
// after: Administration > my_proj > Permissions -> grant 'Execute Analysis' to ci-bot
GET /api/ce/task?id=AX..&additionalFields=stacktrace -> 200
Defensive patterns

Strategy: validation

Validate before calling

// shell: check Scan-level access on the task's project first
curl -s -o /dev/null -w '%{http_code}' -u "$TOKEN:" "$SONAR/api/projects/show?project=$KEY" | grep -q 200 \
  || echo "no Scan-level access to $KEY; /api/ce/task will 403"

Try / catch

try {
  task = ws.get("/api/ce/task?id=" + id);
} catch (ForbiddenException e) {
  log.warn("Requires Administer/Scan globally or on the project");
  throw e;
}

Prevention

When it happens

Trigger: GET /api/ce/task?id=...&additionalFields=... for a project the user/token has no role on; CI scripts querying another team's project tasks; tokens created for one project used against another.

Common situations: Monitoring scripts polling task status across many projects with a single low-privilege token; users removed from project groups; private projects in multi-team instances.

Understand the failure class

Background: "You do not have permission" / 403 Forbidden errors: authenticated but not allowed — causes and fixes across open-source libraries — this error's family across 31 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/ed0cd0a9e917f4c1. Report an issue: GitHub.