{"record":{"id":"aca13a4054b3f070","repo":"SonarSource/sonarqube","slug":"insufficient-privileges-aca13a","errorCode":null,"errorMessage":"Insufficient privileges","messagePattern":"Insufficient privileges","errorType":"exception","errorClass":"ForbiddenException","httpStatus":403,"severity":"error","filePath":"server/sonar-webserver-webapi/src/main/java/org/sonar/server/scannercache/ws/ClearAction.java","lineNumber":101,"sourceCode":"      }\n    } else {\n      cache.clear();\n    }\n    response.noContent();\n  }\n\n  private static void validateParams(ClearRequestDto params) {\n    if (params.branchKey != null) {\n      checkArgument(\n        params.projectKey != null,\n        \"{} needs to be specified when {} is present\",\n        PARAM_PROJECT_KEY, PARAM_BRANCH_KEY);\n    }\n  }\n\n  private void checkPermission() {\n    if (!userSession.hasPermission(GlobalPermission.ADMINISTER)) {\n      throw insufficientPrivilegesException();\n    }\n  }\n}\n","sourceCodeStart":83,"sourceCodeEnd":105,"githubUrl":"https://github.com/SonarSource/sonarqube/blob/184c821202192afc1c599fc912d0889b69fffa53/server/sonar-webserver-webapi/src/main/java/org/sonar/server/scannercache/ws/ClearAction.java#L83-L105","documentation":"api/scannercache/clear wipes the scanner cache used by CI sessions. checkPermission requires the global ADMINISTER (Administer System) permission and throws insufficientPrivilegesException for everyone else. This is a highly privileged maintenance operation, deliberately restricted to system administrators.","triggerScenarios":"Calling POST api/scannercache/clear with a token whose user lacks the global 'Administer System' permission — e.g., a project admin or CI scan token attempting cache cleanup.","commonSituations":"Ops scripts clearing the scanner cache after a SonarQube upgrade run with a non-admin token; users misreading documentation that only the cache GET requires lighter permissions; expired/rotated tokens that lost the admin role.","solutions":["Run the clear operation with a token of a user holding global 'Administer System' permission.","Grant 'Administer System' to the automation user via Administration > Security > Global Permissions (or api/permissions/add_user?permission=admin).","If only cache invalidation for one project is needed, check whether a less privileged endpoint (api/scannercache/get with SCAN) suffices and rely on cache expiry instead.","Confirm the token was not regenerated under a user who lost the admin role."],"exampleFix":"// before: non-admin clears scanner cache\ncurl -u citoken: -X POST \"$SONAR/api/scannercache/clear\"\n\n// after: use a system-admin token\ncurl -u admintoken: -X POST \"$SONAR/api/scannercache/clear\"","handlingStrategy":"try-catch","validationCode":"curl -u \"$TOKEN\": \"$SONAR/api/permissions/user?login=$USER\" | grep '\"permissions\":\\[\"admin\"","typeGuard":null,"tryCatchPattern":"try {\n  wsClient.scannerCache().clear();\n} catch (ServiceErrorException e) {\n  if (e.errors().contains(\"Insufficient privileges\")) {\n    throw new IllegalStateException(\"scannercache/clear requires global Administer System permission\");\n  }\n}","preventionTips":["Use a system-admin token for any api/scannercache/clear call.","Avoid routine cache clears; rely on automatic cache expiry.","Keep admin credentials out of CI logs — use vaulted secrets.","Verify token's user still holds 'Administer System' after role rotations."],"tags":["sonarqube","webapi","authorization","scanner-cache","admin"],"backgroundTag":"insufficient-permissions","analyzedSha":"184c821202192afc1c599fc912d0889b69fffa53","analyzedAt":"2026-09-09T12:23:51.573Z","contentChangedAt":"2026-09-09T12:23:51.573Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}