{"record":{"id":"abba3ec0c48dc211","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-abba3e","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/scannercache/ws/GetAction.java","lineNumber":129,"sourceCode":"      }\n    }\n  }\n\n  private static boolean requestedCompressedData(Request request) {\n    return request.header(\"Accept-Encoding\")\n      .map(encoding -> Arrays.stream(encoding.split(\",\"))\n        .map(String::trim)\n        .anyMatch(\"gzip\"::equals))\n      .orElse(false);\n  }\n\n  private void checkPermission(ProjectDto project) {\n    if (userSession.hasEntityPermission(ProjectPermission.SCAN, project) ||\n      userSession.hasEntityPermission(ProjectPermission.ADMIN, project) ||\n      userSession.hasPermission(SCAN)) {\n      return;\n    }\n    throw insufficientPrivilegesException();\n  }\n}\n","sourceCodeStart":111,"sourceCodeEnd":132,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/scannercache/ws/GetAction.java#L111-L132","documentation":"api/scannercache/get returns cached scanner data for a project. checkPermission grants access to users with project SCAN, project ADMIN, or global SCAN (Execute Analysis) permission; all others get insufficientPrivilegesException. The endpoint is meant for CI accounts and project admins retrieving data cached during analysis.","triggerScenarios":"Calling GET api/scannercache/get?projectKey=... for a project where the token's user has no SCAN/ADMIN project permission and no global Execute Analysis permission.","commonSituations":"CI tokens whose project roles were reset while the global scan permission was also revoked; dashboards fetching scanner cache anonymously; users added only as USER (not SCAN/ADMIN) on the project.","solutions":["Grant global 'Execute Analysis' (scan) permission to the CI user — the standard fix for pipeline tokens.","Or grant the user project SCAN or project ADMIN permission via api/permissions/add_user.","Ensure the request is authenticated and the user is a member of any group that carries the project SCAN permission.","Verify the projectKey matches the project whose permissions were granted (renamed keys are a common mismatch)."],"exampleFix":"// before: user-only role cannot read scanner cache\ncurl -u usertoken: \"$SONAR/api/scannercache/get?projectKey=my.project\"\n\n// after: grant project scan permission\ncurl -u admintoken: -X POST \"$SONAR/api/permissions/add_user?projectKey=my.project&permission=scan&login=jdoe\"","handlingStrategy":"try-catch","validationCode":"curl -u \"$TOKEN\": \"$SONAR/api/permissions/users?projectKey=$PROJECT&login=$USER\" | grep -E '\"scan\"|\"admin\"'\ncurl -u \"$TOKEN\": \"$SONAR/api/permissions/user?login=$USER\" | grep '\"scan\"'","typeGuard":null,"tryCatchPattern":"try {\n  ScannerCache cache = wsClient.scannerCache().get(req.setProjectKey(key));\n} catch (ServiceErrorException e) {\n  if (e.errors().contains(\"Insufficient privileges\")) {\n    // grant project SCAN/ADMIN or global scan to the token's user\n  }\n}","preventionTips":["Give CI users global 'Execute Analysis' so scanner-cache reads work on all projects.","Verify project key matches the project where permissions were granted.","Keep CI tokens' permissions in infrastructure-as-code to avoid drift.","Fall back gracefully (skip cache read) when the user is read-only."],"tags":["sonarqube","webapi","authorization","scanner-cache","ci"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}