{"record":{"id":"7b2e7ccf0fd8afe0","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-7b2e7c","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/project/ws/UpdateVisibilityAction.java","lineNumber":103,"sourceCode":"    boolean changeToPrivate = Visibility.isPrivate(request.mandatoryParam(PARAM_VISIBILITY));\n\n    try (DbSession dbSession = dbClient.openSession(false)) {\n      EntityDto entityDto = dbClient.entityDao().selectByKey(dbSession, entityKey)\n        .orElseThrow(() -> BadRequestException.create(\"Component must be a project, a portfolio or an application\"));\n\n      validateRequest(dbSession, entityDto);\n      visibilityService.changeVisibility(entityDto, changeToPrivate);\n      response.noContent();\n    }\n  }\n\n  private void validateRequest(DbSession dbSession, EntityDto entityDto) {\n    boolean isGlobalAdmin = userSession.isSystemAdministrator();\n    boolean isProjectAdmin = userSession.hasEntityPermission(ADMIN, entityDto);\n    boolean allowChangingPermissionsByProjectAdmins = configuration.getBoolean(CORE_ALLOW_PERMISSION_MANAGEMENT_FOR_PROJECT_ADMINS_PROPERTY)\n      .orElse(CORE_ALLOW_PERMISSION_MANAGEMENT_FOR_PROJECT_ADMINS_DEFAULT_VALUE);\n    if (!isProjectAdmin || (!isGlobalAdmin && !allowChangingPermissionsByProjectAdmins)) {\n      throw insufficientPrivilegesException();\n    }\n    if (entityDto.isProject()) {\n      managedInstanceChecker.throwIfProjectIsManaged(dbSession, entityDto.getUuid());\n    }\n  }\n\n}\n","sourceCodeStart":85,"sourceCodeEnd":111,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/project/ws/UpdateVisibilityAction.java#L85-L111","documentation":"api/projects/update_visibility requires the caller to be a project admin on the entity AND either a system administrator or the server setting allowing project admins to change permissions/visibility must be enabled. validateRequest throws 'Insufficient privileges' when the user is not a project admin, or is neither global admin nor covered by the allowChangingPermissionsByProjectAdmins flag.","triggerScenarios":"POST api/projects/update_visibility by a user without project Admin permission, or by a project admin on a server where core.allowPermissionManagementForProjectAdmins is false (default).","commonSituations":"Users who can see the project but are not on its Admin list; project admins whose visibility changes stopped working after upgrade because the new flag defaults to false; managed (devops-platform) projects also blocked by managedInstanceChecker.","solutions":["Add the user to the project's Admin permission list (Project Settings > Permissions).","Enable sonar.allowPermissionManagementForProjectAdmins=true on the server so project admins may change visibility.","Alternatively perform the change with a global administrator token.","If the project is managed by an external platform, change visibility there rather than via SonarQube."],"exampleFix":"// before (sonar.properties)\n# flag unset -> project admins blocked\n// after\nsonar.allowPermissionManagementForProjectAdmins=true\n// and: Project Settings > Permissions > Administer -> add the user","handlingStrategy":"validation","validationCode":"const authz = await get(`/api/permissions/authorization?projectKey=${key}`, { auth: token });\nconst flag = (await get('/api/settings/values?keys=sonar.allowPermissionManagementForProjectAdmins')).settings[0].value === 'true';\nif (!(authz.permissions.includes('admin') && (authz.globalPermissions.includes('admin') || flag))) throw new Error('Not allowed to change visibility');","typeGuard":"function canChangeVisibility(authz, flagEnabled) {\n  return Boolean(authz) && authz.permissions.includes('admin') && ((authz.globalPermissions || []).includes('admin') || flagEnabled);\n}","tryCatchPattern":"try {\n  await updateVisibility(key, visibility);\n} catch (e) {\n  if (e.response && e.response.status === 403) {\n    throw new Error('Requires project Admin plus (global admin or allowPermissionManagementForProjectAdmins)', { cause: e });\n  }\n  throw e;\n}","preventionTips":["Confirm the user is on the project's Admin list before automating visibility changes.","Enable the allowPermissionManagementForProjectAdmins flag where project admins need this.","For managed projects, change visibility in the source platform (Azure DevOps/GitHub), not SonarQube."],"tags":["sonarqube","webapi","visibility","authorization"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}