{"record":{"id":"38232fdf2f15b6cc","repo":"SonarSource/sonarqube","slug":"insufficient-privileges","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-auth/src/main/java/org/sonar/server/user/AbstractUserSession.java","lineNumber":179,"sourceCode":"  protected List<ComponentDto> doKeepAuthorizedComponents(ProjectPermission permission, Collection<ComponentDto> components) {\n    boolean allowPublicComponent = ProjectPermission.PUBLIC_PERMISSIONS.contains(permission);\n    return components.stream()\n      .filter(c -> (allowPublicComponent && !c.isPrivate()) || hasComponentPermission(permission, c))\n      .toList();\n  }\n\n  @Override\n  public final UserSession checkLoggedIn() {\n    if (!isLoggedIn()) {\n      throw new UnauthorizedException(AUTHENTICATION_IS_REQUIRED_MESSAGE);\n    }\n    return this;\n  }\n\n  @Override\n  public final UserSession checkPermission(GlobalPermission permission) {\n    if (!hasPermission(permission)) {\n      throw new ForbiddenException(INSUFFICIENT_PRIVILEGES_MESSAGE);\n    }\n    return this;\n  }\n\n  @Override\n  public final UserSession checkComponentPermission(ProjectPermission projectPermission, ComponentDto component) {\n    if (!hasComponentPermission(projectPermission, component)) {\n      throw new ForbiddenException(INSUFFICIENT_PRIVILEGES_MESSAGE);\n    }\n    return this;\n  }\n\n  @Override\n  public UserSession checkEntityPermission(ProjectPermission projectPermission, EntityDto entity) {\n    if (hasEntityPermission(projectPermission, entity)) {\n      return this;\n    }\n","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-auth/src/main/java/org/sonar/server/user/AbstractUserSession.java#L161-L197","documentation":"AbstractUserSession.checkPermission throws ForbiddenException when the logged-in user lacks the requested GlobalPermission. Unlike an authentication error, the user is authenticated but not authorized to perform the action.","triggerScenarios":"Calling checkPermission(GlobalPermission.X) (directly or via a webservice handler) when hasPermission(X) is false — user lacks the global permission such as Administer, Provision Projects, or Execute Analysis.","commonSituations":"Non-admin users calling admin-only APIs (api/users, api/settings); CI tokens created from a user without Execute Analysis permission; permission changes after group membership updates.","solutions":["Grant the required global permission in Administration > Security > Global Permissions (directly or via group)","Use a token belonging to a user/account that already holds the permission","If the action is project-scoped, check whether the caller should use project permissions via checkComponentPermission instead of a global permission"],"exampleFix":"// before\nuserSession.checkPermission(GlobalPermission.ADMIN);\n// after\nif (!userSession.hasPermission(GlobalPermission.ADMIN)) {\n  throw new ForbiddenException(\"Global 'Administer System' permission is required; grant it in Administration > Security > Global Permissions\");\n}\nuserSession.checkPermission(GlobalPermission.ADMIN);","handlingStrategy":"try-catch","validationCode":"if (!userSession.hasPermission(GlobalPermission.ADMIN)) {\n  throw new ForbiddenException(\"This action requires the 'Administer System' global permission\");\n}","typeGuard":null,"tryCatchPattern":"try {\n  userSession.checkPermission(GlobalPermission.ADMIN);\n  // perform admin action\n} catch (ForbiddenException e) {\n  if (!e.getMessage().equals(\"Insufficient privileges\")) throw e;\n  // return 403 with the required permission name for the caller\n}","preventionTips":["Check the required permission with hasPermission() before performing costly operations","Grant permissions via groups, not individual users, to avoid drift","For CI, provision dedicated service accounts with exactly the needed global permissions"],"tags":["java","authorization","permissions","sonarqube"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}