{"record":{"id":"042d8f828ab50f58","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-042d8f","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"warning","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/ws/InfoAction.java","lineNumber":59,"sourceCode":"    this.systemPasscode = systemPasscode;\n    this.ceQueue = ceQueue;\n  }\n\n  @Override\n  public void define(WebService.NewController controller) {\n    controller.createAction(\"info\")\n      .setDescription(\"Gets information about Compute Engine. Requires the system administration permission or \" +\n        \"system passcode (see \" + ProcessProperties.Property.WEB_SYSTEM_PASS_CODE.getKey() + \" in sonar.properties).\")\n      .setSince(\"7.2\")\n      .setInternal(true)\n      .setHandler(this)\n      .setResponseExample(getClass().getResource(\"info-example.json\"));\n  }\n\n  @Override\n  public void handle(Request request, Response response) throws Exception {\n    if (!systemPasscode.isValid(request) && !userSession.isSystemAdministrator()) {\n      throw AbstractUserSession.insufficientPrivilegesException();\n    }\n\n    Ce.InfoWsResponse.Builder builder = Ce.InfoWsResponse.newBuilder();\n    CeQueue.WorkersPauseStatus status = ceQueue.getWorkersPauseStatus();\n    builder.setWorkersPauseStatus(convert(status));\n    WsUtils.writeProtobuf(builder.build(), request, response);\n  }\n\n  private static Ce.WorkersPauseStatus convert(CeQueue.WorkersPauseStatus status) {\n    switch (status) {\n      case PAUSING:\n        return Ce.WorkersPauseStatus.PAUSING;\n      case PAUSED:\n        return Ce.WorkersPauseStatus.PAUSED;\n      case RESUMED:\n        return Ce.WorkersPauseStatus.RESUMED;\n      default:\n        throw new IllegalStateException(\"Unsupported WorkersPauseStatus: \" + status);","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/ce/ws/InfoAction.java#L41-L77","documentation":"The api/ce/info Web Service endpoint returns Compute Engine worker pause status only to callers who present a valid system passcode or are authenticated as a system administrator. If neither holds, AbstractUserSession.insufficientPrivilegesException() is thrown and the WS responds 'Insufficient privileges'. This is SonarQube's standard admin-gating for sensitive server-management endpoints.","triggerScenarios":"Calling GET api/ce/info without a valid sonar.authenticator passcode header and without being logged in as a system administrator.","commonSituations":"Scripts or CI tools hitting the CE info WS anonymously; using a regular user account that lacks Administer System permission; stale or wrong sonar.systemPasscode in the client; token belonging to a non-admin user.","solutions":["Log in as a user with the Administer System global permission, or generate a token from such a user and send it as Authorization: Bearer.","If calling programmatically, supply the correct system passcode (value of sonar.systemPasscode on the server) in the request.","Grant the 'Administer System' permission to the account used for automation (Administration > Security > Global Permissions).","Verify the request actually reaches the intended server/organization and that the token was not revoked or expired."],"exampleFix":"// before\ncurl http://sonar.example.org/api/ce/info\n// after\ncurl -u myAdminToken: http://sonar.example.org/api/ce/info","handlingStrategy":"validation","validationCode":"// ensure an admin token is configured before calling\ndef requireAdminToken():\n    token = os.environ.get('SONAR_ADMIN_TOKEN')\n    if not token:\n        raise ValueError('SONAR_ADMIN_TOKEN is required for api/ce/info')\n    return {'Authorization': f'Bearer {token}'}","typeGuard":null,"tryCatchPattern":"try:\n    r = requests.get(f'{SONAR_URL}/api/ce/info', headers=auth)\n    r.raise_for_status()\nexcept requests.HTTPError as e:\n    if r.status_code == 403:\n        raise PermissionError('Use a system-admin token or the system passcode for api/ce/info') from e\n    raise","preventionTips":["Use a dedicated token from a user with Administer System for automation.","Keep the system passcode in a secret store, not hardcoded.","Confirm target server URL and permissions before scripting WS calls.","Never call admin WS endpoints anonymously from CI."],"tags":["sonarqube","webapi","authorization","permissions"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}