{"record":{"id":"7edda7d70831660c","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-7edda7","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/permission/PermissionPrivilegeChecker.java","lineNumber":60,"sourceCode":"  }\n\n  /**\n   * Checks that user is administrator of the specified project\n   * @throws org.sonar.server.exceptions.ForbiddenException if user is not administrator\n   */\n  public static void checkProjectAdmin(UserSession userSession, Configuration config, @Nullable EntityDto entity) {\n    userSession.checkLoggedIn();\n\n    if (userSession.hasPermission(GlobalPermission.ADMINISTER)) {\n      return;\n    }\n\n    boolean allowChangingPermissionsByProjectAdmins = config.getBoolean(CORE_ALLOW_PERMISSION_MANAGEMENT_FOR_PROJECT_ADMINS_PROPERTY)\n      .orElse(CORE_ALLOW_PERMISSION_MANAGEMENT_FOR_PROJECT_ADMINS_DEFAULT_VALUE);\n    if (entity != null && allowChangingPermissionsByProjectAdmins) {\n      userSession.checkEntityPermission(ProjectPermission.ADMIN, entity);\n    } else {\n      throw insufficientPrivilegesException();\n    }\n  }\n}\n","sourceCodeStart":42,"sourceCodeEnd":64,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/permission/PermissionPrivilegeChecker.java#L42-L64","documentation":"Permission management endpoints (api/permissions/*) allow changing a project's permissions only if the caller has Admin permission on the entity AND the server setting sonar.allowPermissionManagementForProjectAdmins (core.allowPermissionManagementForProjectAdmins) is enabled. PermissionPrivilegeChecker.checkProjectAdmin throws 'Insufficient privileges' when the property is disabled (falling back to the default) or the entity is null/unavailable.","triggerScenarios":"A project admin calls permission WS endpoints while CORE_ALLOW_PERMISSION_MANAGEMENT_FOR_PROJECT_ADMINS_PROPERTY is false (default); or checkProjectAdmin is invoked without a resolvable entity.","commonSituations":"Upgraded servers where project admins previously could edit permissions now cannot because the flag defaults to disabled; Terraform/API automation assigning project permissions with an admin-scoped-to-project account; instance admins who forgot to enable the setting.","solutions":["Set sonar.allowPermissionManagementForProjectAdmins=true in sonar.properties (Administration > Configuration) and restart if needed.","Use a token from a global administrator (global Administer permission) for permission management calls.","Ensure the request targets an existing project so `entity` resolves rather than being null."],"exampleFix":"// before (sonar.properties)\n# sonar.allowPermissionManagementForProjectAdmins not set\n// after\nsonar.allowPermissionManagementForProjectAdmins=true","handlingStrategy":"validation","validationCode":"const settings = await get('/api/settings/values?keys=sonar.allowPermissionManagementForProjectAdmins');\nconst flagEnabled = settings.settings[0] && settings.settings[0].value === 'true';\nconst authz = await get(`/api/permissions/authorization?projectKey=${key}`);\nif (!(authz.permissions.includes('admin') && flagEnabled)) throw new Error('Project-admin permission editing disabled or no project Admin permission');","typeGuard":"function canEditProjectPermissions(authz, flagEnabled) {\n  return Boolean(authz && authz.permissions.includes('admin')) && flagEnabled === true;\n}","tryCatchPattern":"try {\n  await assignProjectPermission(key, user, perm);\n} catch (e) {\n  if (e.response && e.response.status === 403) {\n    throw new Error('Enable sonar.allowPermissionManagementForProjectAdmins or use a global admin token', { cause: e });\n  }\n  throw e;\n}","preventionTips":["Set sonar.allowPermissionManagementForProjectAdmins=true if project admins must manage permissions.","Use global-admin tokens for permission automation to avoid dependence on the flag.","After upgrades, re-verify this flag since its default is disabled."],"tags":["sonarqube","webapi","permissions-management","configuration"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}