{"record":{"id":"49dbfeabcaae15e4","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-49dbfe","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"http","errorClass":"ForbiddenException","httpStatus":403,"severity":"warning","filePath":"server/sonar-webserver-webapi-v2/src/main/java/org/sonar/server/v2/api/system/controller/DefaultLivenessController.java","lineNumber":48,"sourceCode":"  private final LivenessChecker livenessChecker;\n  private final UserSession userSession;\n  private final SystemPasscode systemPasscode;\n\n  public DefaultLivenessController(LivenessChecker livenessChecker, SystemPasscode systemPasscode, @Nullable UserSession userSession) {\n    this.livenessChecker = livenessChecker;\n    this.userSession = userSession;\n    this.systemPasscode = systemPasscode;\n  }\n\n  @Override\n  public void livenessCheck(String requestPassCode) {\n    if (systemPasscode.isValidPasscode(requestPassCode) || isSystemAdmin()) {\n      if (livenessChecker.liveness()) {\n        return;\n      }\n      throw new IllegalStateException(\"Liveness check failed\");\n    }\n    throw new ForbiddenException(\"Insufficient privileges\");\n  }\n\n  private boolean isSystemAdmin() {\n    if (userSession == null) {\n      return false;\n    }\n    return userSession.isSystemAdministrator();\n  }\n\n}\n","sourceCodeStart":30,"sourceCodeEnd":59,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi-v2/src/main/java/org/sonar/server/v2/api/system/controller/DefaultLivenessController.java#L30-L59","documentation":"ForbiddenException thrown by DefaultLivenessController.livenessCheck when the request carries neither a valid X-Sonar-Passcode header nor an authenticated session with Administer System permission. The endpoint intentionally restricts liveness details to privileged callers.","triggerScenarios":"Calling GET /api/v2/system/liveness without the X-Sonar-Passcode header matching the configured sonar.web.systemPasscode, and without being logged in as a system admin.","commonSituations":"Kubernetes probes not configured with the passcode, monitoring scripts missing the header, passcode changed in sonar.properties but not updated in probe configuration.","solutions":["Set sonar.web.systemPasscode in sonar.properties and send it as the X-Sonar-Passcode header","Authenticate the caller as a user with Administer System permission","Update monitoring/probe configs after changing the passcode","If probing unauthenticated is required, ensure a valid passcode is provisioned to the probe"],"exampleFix":"// before\ncurl http://sonarqube:9000/api/v2/system/liveness\n// after\ncurl -H \"X-Sonar-Passcode: $SONAR_PASSCODE\" http://sonarqube:9000/api/v2/system/liveness","handlingStrategy":"validation","validationCode":"// ensure header is set before calling\nif [ -z \"$SONAR_PASSCODE\" ]; then echo \"X-Sonar-Passcode missing\" >&2; exit 1; fi\ncurl -sf -H \"X-Sonar-Passcode: $SONAR_PASSCODE\" http://sonarqube:9000/api/v2/system/liveness","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always send X-Sonar-Passcode on system endpoints","Or authenticate as an Administer System user","Rotate passcode config and monitoring secrets together"],"tags":["java","authorization","forbidden"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}