SonarSource/sonarqube · error · ForbiddenException

You're not authorized to push analysis results to the SonarQ

Error message

You're not authorized to push analysis results to the SonarQube server. Please contact your SonarQube administrator.

What it means

ProjectDataLoader.checkPermission verifies the submitting user holds the 'scan/provisioning' permission before accepting uploaded analysis data. Without it the loader refuses to import the report and throws ForbiddenException with this user-facing message. It prevents unauthorized pushes of analysis results to the server.

Source

Thrown at server/sonar-webserver-webapi/src/main/java/org/sonar/server/batch/ProjectDataLoader.java:88

  }

  private List<FilePathWithHashDto> searchFilesWithHashAndRevision(DbSession session, @Nullable ComponentDto branchComponent) {
    if (branchComponent == null) {
      return Collections.emptyList();
    }
    return dbClient.componentDao().selectEnabledFilesFromProject(session, branchComponent.uuid());
  }

  private static void addFileData(ProjectRepositories data, List<FilePathWithHashDto> files) {
    for (FilePathWithHashDto file : files) {
      FileData fileData = new FileData(file.getSrcHash(), file.getRevision());
      data.addFileData(file.getPath(), fileData);
    }
  }

  private static void checkPermission(boolean hasScanPerm) {
    if (!hasScanPerm) {
      throw new ForbiddenException("You're not authorized to push analysis results to the SonarQube server. " +
        "Please contact your SonarQube administrator.");
    }
  }

}

View on GitHub (pinned to 184c821202)

Solutions

Grant the 'Execute Analysis' permission to the CI user/group on the project (Project Settings > Permissions)
Regenerate the scanner token from an account that has Execute Analysis
If permissions come from a DevOps platform, sync/group membership there and re-authenticate
Check global 'Execute Analysis' permission if the project is not yet provisioned

Example fix

// before: scanner token of plain user
SONAR_TOKEN=user-low-priv-token
// after: token of account with Execute Analysis on the project
SONAR_TOKEN=ci-service-account-token

Defensive patterns

Strategy: validation

Validate before calling

// before pushing, verify permission:
GET api/permissions/search?project=<key>&permission=scan — confirm the token's user appears

Try / catch

try { loader.load(...); } catch (ForbiddenException e) { failBuild("Grant Execute Analysis to the CI account"); }

Prevention

Use a dedicated CI account with Execute Analysis on all analyzed projects
After SonarQube upgrades, re-check permission templates (Anyone group changes)
Regenerate tokens from accounts whose permissions you control

When it happens

Trigger: A scanner or CI job authenticates with a token whose user lacks the Execute Analysis (scan) permission on the project, and posts to api/batch/project (internal batch endpoints).

Common situations: SonarQube upgrade from versions where scan permission was granted to Anyone; token created for a user who lost project permissions; CI service account not added to the project with Execute Analysis; externally managed instance revoking local permissions.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/ab27f54028da9263. Report an issue: GitHub.